@pixel-point/toolcraft 0.0.17 → 0.0.19

package/templates/starter/docs/toolcraft/performance.md

@@ -1,6 +1,6 @@
 # Toolcraft Performance Contract
 
-<!-- toolcraft-performance-lifecycle: first-delivery=functional; later-delivery=functional-targeted; complaint=one-authority-targeted-performance-iteration; full-audit=explicit-only -->
+<!-- toolcraft-performance-lifecycle: first-delivery=functional-complete; later-edits=focused-only; complaint=one-authority-targeted-performance-iteration; full-audit=explicit-only -->
 <!-- toolcraft-performance-iteration: authority=exact-request-evidence+canonical-path-ids; fixture=reachable-development; after-pass=return-app-to-user+stop -->
 <!-- toolcraft-performance-full-authority: automatic=forbidden; recommendation=two-compatible-iterations-or-broad-unlocalizable-problem; command=pnpm verify:perf; authority=explicit-user-request-or-accepted-offer -->
 <!-- toolcraft-performance-routing: localized=agent-targeted; ambiguous=one-user-facing-choice; broad=offer-targeted-or-full; full=explicit-only -->
@@ -94,15 +94,13 @@ Do not use an umbrella viewport scenario when a concrete viewport path exists. E
 
 Scenario interaction is the canonical pipeline interaction from its derived path, such as `control-drag`, `viewport-drag`, `viewport-zoom`, `initial-render`, or `export`. Do not introduce scenario-only aliases or umbrella interaction names.
 
-`src/app/app-verification-impact.json` maps every current product production module to `presentation`, `functional`, or `performance` impact and names its nearest acceptance ids. A performance entry is reserved for a module that can change a named pass's execution, invalidation, workload, resource lifecycle, or measured output, and names only those exact pass ids. The inventory contains no stale or missing module paths; blanket every-module acceptance or pass ownership is invalid. This mapping is the authority for verification scope after first delivery.
-
-Keep frequently edited product defaults and domain behavior in focused product modules whose ownership entries name only their nearest acceptance ids. `app-schema.ts` remains the public assembly boundary, but it should import those domain definitions instead of accumulating every mutable product decision in one file. A change made directly in a blanket schema owner correctly selects every acceptance id owned by that file; module boundaries are therefore part of later-delivery feedback speed, not cosmetic organization.
+Keep frequently edited product defaults and domain behavior in focused product modules so later feature tests can target the edited behavior without loading unrelated product areas. `app-schema.ts` remains the public assembly boundary, but it should import those domain definitions instead of accumulating every mutable product decision in one file. Module boundaries improve development feedback speed; they do not authorize aggregate or measured proof.
 
 Viewport drag and zoom normally stay in transforms or uniforms and must not invalidate expensive passes. A render-scale-enabled raster product may rerasterize on `viewport-zoom` only through an off-main `rasterize` pass with `quality: "retina"`; this is the narrow exception that preserves exact CSS × DPR × selected-scale backing as the visible zoom size changes. Main-thread, non-retina, drag-time, and unrelated expensive invalidations remain invalid.
 
 Each measured interaction phase performs one primary user operation. State-restoring inverse actions belong in a later phase or outside the measurement, never in the same action. Non-animation interaction probes collect at least 20 post-action frames so nearest-rank p95 remains a percentile rather than collapsing to the single maximum frame; animation keeps its dedicated 120-frame sample and export keeps completion-owned timing.
 
-A change isolated to product performance adapters or performance test support selects code-health and any directly affected unit proof for ordinary delivery, but it never infers a measured path. Exact request authority may consume the adapter's performance candidates in one targeted iteration, while explicit `pnpm verify:perf` remains the only full-audit route.
+A change isolated to product performance adapters or performance test support runs only its directly affected unit proof during ordinary editing and never infers a measured path. Exact request authority may consume the adapter's performance candidates in one targeted iteration, while explicit `pnpm verify:perf` remains the only full-audit route.
 
 ## 6. Fixture Adapters And Plans
 
@@ -138,9 +136,9 @@ Artifact dimensions, decoded quality, video duration, and exact 30 FPS packet ca
 
 ## 8. Demand-Only Performance Lifecycle
 
-During implementation, run targeted unit and functional browser checks for feedback without minting delivery evidence. At the coherent delivery boundary, the protected delivery runner diffs current sources against the immediately previous successful delivery and resolves changed modules through `app-verification-impact.json`. Every functional delivery requires only its ownership-derived functional proof, including changes to performance-owned modules. Performance ownership constrains an exact request-authorized iteration; it does not authorize measurements. A durable full-performance baseline, when one exists, remains historical evidence and is not reused as the functional-delivery diff anchor. Reports remain bound to their executed plan, nonce, and current source hash; product-authored JSON is not evidence.
+During implementation, run targeted unit and functional browser checks for feedback without minting delivery evidence. The protected runner creates complete functional evidence only for first product delivery. After that initial receipt exists, ordinary edits run only directly relevant focused checks; a repeated bare `verify:delivery` exits before inventory, build, tests, export, and performance work. A durable full-performance baseline, when one exists, remains independent historical evidence. Targeted and full performance reports remain bound to their executed plan, nonce, and current source hash; product-authored JSON is not evidence.
 
-First and later functional gates validate every structural envelope, pipeline, path, fixture, and adapter invariant with the runtime-owned deferred coverage policy. They may expose unresolved benchmark requirements but do not require `kernelBenchmarkDecisions`, run `verify:kernel`, or read a kernel receipt. Default strict coverage and authorized performance execution retain those requirements.
+The first functional gate validates every structural envelope, pipeline, path, fixture, and adapter invariant with the runtime-owned deferred coverage policy. It may expose unresolved benchmark requirements but does not require `kernelBenchmarkDecisions`, run `verify:kernel`, or read a kernel receipt. Later focused feature checks validate the structures they edit. Default strict coverage and authorized performance execution retain the full requirements.
 
 Ordinary changes and performance metadata cannot authorize measured performance. Only exact complaint/request authority can create one measured targeted performance iteration. Changed files, tier, ownership, passes, paths, pipeline, boundary, adapter, interaction, output, or subsystem never authorize it. Once authorized, run only the exact `browser perf:` paths named by the request authority; unrelated paths and the full suite remain outside the iteration.
 
@@ -149,9 +147,9 @@ The protected performance-iteration runner requests each path's compiled develop
 The conversational lifecycle is automatic:
 
 1. **First product delivery.** Bare `pnpm verify:delivery` proves complete product contracts, performs one production build, and runs full functional acceptance with no measured performance. The receipt preserves any independent full-performance baseline and cannot claim targeted or full performance evidence.
-2. **Later functional-targeted delivery.** The same bare command derives exact ownership-required functional checks from the current inputs and immediately previous successful delivery. It preserves a baseline when present and cannot silently run measured performance or create one.
+2. **Later ordinary edits.** Run only the directly relevant product tests and browser checks. The same bare command is a protected no-op that preserves the initial receipt and any performance checkpoints without reading current inventory or launching aggregate proof.
 3. **Localized or clarified targeted work.** Only a localized complaint or a post-clarification targeted choice records an exact request quote and canonical affected path IDs in the latest Decision Trail. Classifier output establishes complaint authority only and never path localization. Any unresolved localization creates neither performance-iteration intent nor canonical path authority, whether classification returned high-confidence `performance-iteration` or `needs-agent-judgment`. One bare `pnpm verify:delivery` then runs one targeted iteration against the reachable development fixture. The protected report stores independently validated `cold`, `warm`, and `sustained` measurements; compatible prior evidence produces diagnostic deltas, while absent or incompatible evidence records a non-comparable result. Current absolute budgets remain the pass/fail authority. Deliver the verified app, then stop and wait for user evaluation. Each later localized request may create one new bounded iteration.
-4. **Full audit.** Only an explicit operator request or accepted offer authorizes `pnpm verify:perf`. It performs one fresh production build and the complete maximum-fixture performance matrix, updates only the performance checkpoints, and preserves the delivery anchor.
+4. **Full audit.** Only an explicit operator request or accepted offer authorizes `pnpm verify:perf`. It performs one fresh production build and the complete maximum-fixture performance matrix, updates only the full-performance checkpoint, and preserves the initial delivery receipt and targeted-performance history.
 
 Use the runtime request classifier as a guard, not as a substitute for understanding the user. It returns high-confidence `performance-iteration`, high-confidence ordinary product work, or `needs-agent-judgment`. High-confidence ordinary product instructions stay ordinary. Classifier output establishes complaint authority only and never path localization. A localized complaint lets the agent select the affected canonical paths and run one targeted iteration without asking the user. For an ambiguous complaint, ask one user-facing question naming the visible operation and offering targeted diagnosis or a complete performance review; never ask the user to choose internal path IDs, and create neither performance-iteration intent nor canonical path authority before the answer. A broad or honestly unlocalizable problem may lead to that single targeted/full choice with a recommendation for complete performance review, but only the user's choice authorizes it. A direct complete-performance-review request runs `pnpm verify:perf` without another clarification. Iteration mode requires `Performance intent: performance-iteration — Request evidence: "<verbatim exact Request quote>"` in the worklog before the command runs. The quote must be a nontrivial exact raw substring of the current Request, including identical whitespace and Unicode code units; invented, whitespace-collapsed, or NFKC-equivalent evidence is invalid.
 
@@ -165,7 +163,7 @@ Canonical classification examples:
 - wording such as “the controls feel sticky” or “something feels off” needs agent judgment from the full request; if localization remains unresolved, ask the one visible-operation targeted/full question and record no iteration or path authority before the answer;
 - classification is clause-local: an independent complaint may establish complaint authority even when another clause negates a different complaint or requests a product speed change, while localization is still resolved separately.
 
-Use bare `pnpm verify:delivery` once for the coherent delivery batch. Complaint wording, repetition, filename, diagnostic classification, and touched subsystem never launch the complete matrix automatically. A targeted failure triggers targeted diagnosis, not an automatic full-suite run, and a passing iteration stops after returning the verified app for user evaluation.
+Use bare `pnpm verify:delivery` once for first product delivery or one authority-backed targeted performance iteration. Do not use it as a later ordinary edit gate. Complaint wording, repetition, filename, diagnostic classification, and touched subsystem never launch the complete matrix automatically. A targeted failure triggers targeted diagnosis, not an automatic full-suite run, and a passing iteration stops after returning the verified app for user evaluation.
 
 After two consecutive compatible protected performance iterations, the runner emits a recommendation and the agent must offer a slower complete audit if the user remains unsatisfied. A demonstrably broad or unlocalizable cross-system problem may justify offering it earlier through semantic agent judgment; do not reduce that decision to the number of selected paths.
 

package/templates/starter/docs/toolcraft/renderer-technique.md

@@ -14,7 +14,7 @@ Use the same producer order for every custom renderer:
 4. Run `assessToolcraftRenderPlan`; resolve errors and run protected `pnpm verify:kernel` only when the assessment requires candidate evidence.
 5. Derive canonical paths and compile combined fixtures through their adapters.
 6. Implement the selected renderer and run targeted checks for the paths being developed.
-7. Run lifecycle-appropriate delivery proof: full functional acceptance with no measured performance for first product delivery, exact ownership-derived functional checks for later work, or one targeted iteration for a performance complaint. Full certification is a separate operator/CI command.
+7. Run lifecycle-appropriate proof: full functional acceptance with no measured performance for first product delivery, feature-focused tests only for later ordinary edits, or one targeted iteration for a performance complaint. Full certification is a separate operator/CI command.
 
 Do not write renderer code before the envelope, `rendererTechnique`, pipeline, and assessment exist.
 
@@ -27,6 +27,10 @@ Do not write renderer code before the envelope, `rendererTechnique`, pipeline, a
 - Prefer retained resources and stable cache keys. Source-bound resources live outside React render, survive unrelated interactions according to pass lifecycle, and release during cleanup.
 - Separate layers when they have different semantics, invalidation, lifecycle, interaction, or export treatment. A costly layer does not force unrelated output into the same renderer.
 - Preserve selected quality, product boundaries, backing resolution, and source fidelity. A renderer is not accepted by silently reducing them.
+- In infinite mode, custom Canvas 2D, WebGL, and WebGPU previews use `useToolcraftProductSceneFrame()` as their backing and coordinate frame. Do not keep rendering into dormant finite `canvas.size`, derive another bounds wrapper, or measure DOM geometry; runtime already positions the product scene surface from `sceneBoundsProvider`.
+- A preview-only environment that must stay fixed to the complete Infinity
+  viewport uses `infiniteCanvasContent`, not the bounded product renderer. Keep
+  that layer pointer-transparent and exclude it from scene bounds and export.
 
 When assessment requires a benchmark, declare `kernelBenchmarkDecisions`, implement only the named executable candidates in `e2e/app-kernel-benchmarks.ts`, and let protected `pnpm verify:kernel` measure them at the exact combined workload vector. Candidate outputs must be deterministic and equal at full quality. Do not author timing values or add speculative benchmark metadata when generic assessment resolves the choice.
 
@@ -110,7 +114,7 @@ The `mount*` and error functions above stand for product renderer integration on
 
 The presentation lease is keyed by canonical document reference and shares immutable geometry/material/texture GPU resources across preview and export while cloning only scene roots. Replacement, delete/reset, failed creation, release, and provider unmount dispose ownership deterministically. The original uploaded folder/ZIP remains immutable durable source; display fit and camera pose live outside the leased root.
 
-The runtime presents structurally valid analyzing or repairing geometry at `0.4` opacity and committed clean/fixed geometry at `1`. Export is always `1`. Runtime image/video export composites visible committed model layers before awaiting the product's shared `ToolcraftAppComposition.exportRenderer` frame. Runtime owns the presentation binding, pose, scene frame, dimensions, pixel ratio, encoding, and download; product code does not call model compositors or construct a parallel export host.
+The runtime presents structurally valid analyzing or repairing geometry at `0.4` opacity and committed clean/fixed geometry at `1`. Export is always `1`. Runtime image/video export composites visible committed model layers before awaiting the product's shared `ToolcraftAppComposition.exportRenderer` frame. Models are not silently traced for SVG; explicit SVG delivery requires product-authored editable vector content through `svgExportRenderer`. Runtime owns presentation binding, pose, scene frame, dimensions, pixel ratio, validation/encoding, and download; product code does not call model compositors or construct a parallel export host.
 
 When `viewInteraction.mode` is `orbit`, schema `orientationGizmo`, direct model drag, preview rendering, hit testing, reset/history, and export share every declared orientation pose target. The product renderer supplies geometry-aware `hitTest`; Toolcraft owns gesture scheduling and history through `useToolcraftModelOrbitInteraction`.
 

package/templates/starter/docs/toolcraft/schema-reference.md

@@ -18,7 +18,7 @@ Top-level schema fields:
 | `settingsTransfer` | Runtime-owned Export Settings / Import Settings identity.              | `core/setup-export.md`                                                     |
 | `panelActions`     | Sticky product delivery actions such as export, copy, generate, apply. | `core/setup-export.md`, `core/control-selection.md`                        |
 
-Schema controls always bind to a `target`, use `defaultValue` for reset behavior, and include `performanceRole` / `performanceReason` on visible non-action controls. Use built-in control `type` values before `controlRenderers`.
+Schema controls always bind to a `target`, use `defaultValue` for reset behavior, and include `performanceRole` / `performanceReason` on visible non-action controls. Use built-in control `type` values before `controlRenderers`. Built-in targets have one canonical runtime value model through defaults, seeded/live state, undo/reset, persistence, settings transfer, and keyframes; renderers never decode React callback shapes. `color` state is an expanded uppercase `#RRGGBB` string even though Color emits `{ hex }`. Compound/collection values keep their documented models; ordinary `fileDrop` bytes stay outside `state.values`.
 
 ## Canvas
 
@@ -42,14 +42,14 @@ Custom product output declares bounds on the composition:
 ```tsx
 export const appComposition: ToolcraftAppComposition = {
   canvasContent: <ProductCanvas />,
-  sceneBoundsProvider: ({ state, timeRange }) => [
-    getVisibleProductSceneRect(state, timeRange),
+  sceneBoundsProvider: ({ state }) => [
+    getVisibleProductSceneRect(state),
   ],
   schema: appSchema,
 };
 ```
 
-The provider returns world-space `{ x, y, width, height }` rectangles. Runtime unions them once with visible image/model frames. It is called only for infinite export; video passes the requested time range so the provider can return one complete animation envelope. Product code does not read DOM bounds or the dormant finite size.
+The provider returns world-space `{ x, y, width, height }` rectangles for one exact state. Runtime uses their union for the live infinite product scene, unions them with visible image/model frames for export, and calls the provider for every scheduled video state before forming one stable envelope. Canvas 2D, WebGL, and WebGPU product output calls `useToolcraftProductSceneFrame()` inside `canvasContent` for active backing size and world-to-local translation. Product code does not read DOM bounds, author a time-range envelope, or reuse dormant finite size in infinite mode.
 
 Use `canvas.renderScale: true` or `canvas.renderScale: { step }` only for non-vector raster previews such as Canvas 2D, WebGL, or WebGPU. For this field, product code may customize only the slider step; authored schema cannot set `enabled`, `min`, `defaultValue`, or `max`. Runtime resolves enabled render scale to `{ enabled: true, min: 1, defaultValue: 2, max: 2, step }`, using `0.25` when no step is authored. A custom step must be finite, between `0.01` and `1`, and evenly partition the canonical `1..2` range so `2` remains reachable; invalid input fails fast. Do not enable it for DOM/SVG/vector-native previews. Enabling it requires one browser runtime acceptance row targeting `canvas.renderScale` with `renderScaleCoverage.kind: "selected-backing-pixels"` and exact sorted states `["interaction", "steady"]`, plus `"playback"` when timeline is enabled. The fixed `canvas-render-scale-backing` recipe proves actual backing pixels rather than timing.
 
@@ -89,7 +89,7 @@ media: {
 
 `sourceTarget` must match a compatible `fileDrop` control target. Runtime shows the asset as an attached file, users can remove it, and Reset restores it. Model defaults require `assetKind: "model"`, a root `fileName`, and complete local `sourceFiles`; each source uses a serializable `dataUrl` plus its bundle-relative `path`. Runtime restores default models through the same validation, analysis, repair, repository, and rendering pipeline as a user upload. Persisted empty media remains empty until Reset and must not silently resurrect defaults.
 
-For a multi-item `fileDrop`, `recommendedMaxItems` is advisory. `hardMaxItems`, when present, must be a finite nonnegative safe integer and is enforced before decode or storage allocation. Additive imports count current assets with the same `sourceTarget` plus the incoming logical batch; replacement imports count only the incoming batch.
+For a multi-item `fileDrop`, `recommendedMaxItems` is advisory. `hardMaxItems`, when present, must be a finite nonnegative safe integer and is enforced before decode or storage allocation. Additive imports count current assets with the same `sourceTarget` plus the incoming logical batch; replacement imports count only the incoming batch. A `fileDrop` with `assetKind: "file"`, `multiple: true`, and `variant: "collection-actions"` may declare `itemControls`; each entry uses a supported built-in collection item control and declares `defaultValue`. Attached files render these controls directly beneath their upload row, values persist at the parent target as records keyed by `mediaId`, and file bytes remain runtime-owned media.
 
 ## Model FileDrop
 
@@ -158,9 +158,9 @@ Common control fields:
 | `defaultValue`      | Initial value and reset value.                                                                                               |
 | `label`             | Short UI label, `false`, or omitted.                                                                                         |
 | `description`       | Product-specific help text only when it adds meaning beyond the label.                                                       |
-| `visibleWhen`       | Mode/type/source/include/variant/count visibility. Hidden values are preserved.                                              |
+| `applicability`     | Required product claim: `{ mode: "always" }` or `{ mode: "conditional", all: [...] }`. Hidden values are preserved.       |
 | `orderRole`         | Makes section order testable.                                                                                                |
-| `semanticGroup`     | Language-independent product sub-entity/workflow grouping, required on every control in sections larger than seven controls. |
+| `semanticGroup`     | Language-independent product sub-entity/workflow grouping, required on every control in sections with eight to ten controls and on every plain Color when a mixed section contains multiple plain Colors. |
 | `sliderValueKind`   | `slider` intent: `"continuous"` or `"discrete"`.                                                                             |
 | `textValueKind`     | `text`/`code` intent: `"single-line"`, `"multiline"`, or `"structured"`.                                                     |
 | `curveIntent`       | `curves` composition: `"single-value-map"` or `"color-channels"`.                                                            |
@@ -170,11 +170,9 @@ Common control fields:
 | `keyframeable`      | Timeline/keyframe capability override when structurally needed.                                                              |
 | `variant`           | Component-specific variant.                                                                                                  |
 
-Use `visibleWhen` for product availability. Do not use `disabled`, `disabledWhen`, or inert visible controls for generated product branches.
+Every authored product control declares `applicability`: use `{ mode: "always" }` only when it affects its accepted outcome in every finite sibling-selector branch, or `{ mode: "conditional", all: [...] }` when every predicate must match. Inactive controls are absent while values remain preserved. Do not use `disabled`, `disabledWhen`, or inert visible controls for availability. Legacy control `visibleWhen` remains readable only at the low-level compatibility boundary; product acceptance rejects it and omitted applicability. Section `visibleWhen` remains a separate legacy section-layout feature.
 
-Conditions support `equals`, `notEquals`, `oneOf`, `notOneOf`, `greaterThan`, `greaterThanOrEqual`, `lessThan`, and `lessThanOrEqual`.
-
-Reserved runtime targets include `runtime.settingsTransfer`, `canvas.infinity`, `canvas.aspectRatio`, `canvas.size.width`, `canvas.size.height`, `canvas.renderScale`, and `panels.timeline.extended`. Product sections must not declare those controls.
+Conditions support `equals`, `notEquals`, `oneOf`, `notOneOf`, `greaterThan`, `greaterThanOrEqual`, `lessThan`, and `lessThanOrEqual`. Reserved runtime targets include `runtime.settingsTransfer`, `canvas.infinity`, `canvas.aspectRatio`, `canvas.size.width`, `canvas.size.height`, `canvas.renderScale`, and `panels.timeline.extended`; product sections must not declare them.
 
 ## Built-In Control Types
 
@@ -194,6 +192,7 @@ Reserved runtime targets include `runtime.settingsTransfer`, `canvas.infinity`,
 | `checkbox` | `Checkbox` |
 | `actions` | `Actions` |
 | `collectionActions` | `CollectionActions` |
+| `sourceCollection` | `ControlsPanelCollectionItems` |
 | `panelActions` | `PanelActions` |
 | `colorOpacity` | `ColorOpacity` |
 | `palette` | `Palette` |
@@ -210,7 +209,7 @@ Reserved runtime targets include `runtime.settingsTransfer`, `canvas.infinity`,
 | `settingsTransfer` | `SettingsTransfer` |
 [//]: # (toolcraft-contract:built-in-control-table:end)
 
-Use `component-rules.md` for component-specific fit, labels, variants, units, parser behavior, and exceptions. Use `core/control-selection.md` before deciding a custom control is needed.
+Use `component-rules.md` for component-specific fit, labels, variants, units, parser behavior, and exceptions. `sourceCollection` renders a supported built-in `itemControl` for a source-owned array without add/remove UI; `collectionActions` owns user cardinality and its limits. Use `itemControl` for one homogeneous repeated value. For one logical repeated entity made from two or more built-in fields, use `itemControls`; for example, `{ type: "collectionActions", target: "surface.layers", defaultValue: [{ strength: 0.4, invert: false }], itemControls: { strength: { type: "slider", defaultValue: 0.5 }, invert: { type: "switch", defaultValue: false } } }`. Every field requires `defaultValue`; `itemControl` and `itemDefaultValue` are invalid competing template sources. `+` appends the complete defaults, `−` removes the final record, edits preserve sibling/product keys, and runtime places a line only between compound records without `Item N` headings. Standalone color `itemControl` remains a divider-free two-column grid. Use `core/control-selection.md` before deciding a custom control is needed.
 
 `orientationGizmo` uses a non-degenerate `{ position: [x, y, z], up: [x, y, z] }` default, `label: false`, and `keyframeable: false`. Declare one target for the active/selected model and keep it beside at least one visible product control in the semantic model/view section; runtime renders the handle on the canvas rather than in the controls panel. Multiple declarations require statically provable mutually exclusive combined section/control visibility conditions, because runtime permits at most one active orientation handle.
 
@@ -221,6 +220,7 @@ before schema controls or renderer code:
 
 ```ts
 export const starterProductReadiness: ToolcraftProductReadiness = {
+  exportIntent: { image: { mode: "toolcraft-default" }, svg: { mode: "not-requested" }, video: { mode: "not-requested" } },
   interactionOwnership: [],
   mode: "product",
   productName: "Model Studio",
@@ -290,22 +290,22 @@ exactly match schema `orientationGizmo` targets.
 ## Control Section Inventory
 
 Before writing `panels.controls.sections`, export `starterControlSectionInventory` beside `starterAcceptance`:
-
 ```ts
 export const starterControlSectionInventory = [
   {
     entity: "Text block",
-    groupingReason:
-      "These controls edit the text content, typography, and visible text fill together.",
+    entityId: "text-block",
+    groupingReason: "These controls edit the text content, typography, and visible text fill together.",
+    id: "text",
     targets: ["text.content", "text.font"],
     title: "Text",
   },
 ] as const;
 ```
 
-Every product control target appears exactly once in the inventory. Runtime `Setup`, sticky footer `Export`, settings transfer, and runtime canvas sizing targets do not need entries.
-
-For sections larger than seven controls, each control also declares `semanticGroup`. Controls editing one tightly scoped product sub-entity share the same value; mixed groups make a broad section fail and should be split. This fact is structural and may not be inferred from English labels.
+- Every product control target appears exactly once in the inventory. Runtime-owned `Setup`, sticky footer `Export`, settings transfer, and runtime canvas sizing targets do not need entries. The product targets authored in the standard `Background` source section remain in its `Background` inventory entry after runtime relocates those controls into `Setup`. Stable `entityId` is the primary grouping authority; target namespaces are only secondary diagnostics.
+- Keep one logical entity in one section through ten controls. One to seven controls is the normal size; sections with eight to ten controls require `semanticGroup` on every control. Controls editing one tightly scoped product sub-entity share the same group, and this fact may not be inferred from English labels.
+- When one entity has more than ten controls, split it into balanced workflow sections containing two to ten controls. Every split section keeps the same `entityId` and `entity`, declares a unique `workflowStage`, and provides a concrete `splitReason`. Do not create a one-control tail.
 
 ## Transfer Metadata
 
@@ -313,15 +313,17 @@ Reference and motion metadata lives in `starterTransferMode`.
 
 Use `transferMode: "reference-runtime-clone"` when porting an existing app unless the user explicitly asks for redesign. Reference clones declare `referenceStudy`, `referenceFeatureInventory`, and acceptance mapping; detailed evidence requirements live in `core/reference-study.md`.
 
-Video references declare `videoReferenceStudy` before implementation. Animated products declare `animationIntent`, and playback/keyframe timeline apps declare a proven loop duration when known. Detailed animation rules live in `core/timeline-animation.md`.
+Every product readiness declaration includes required `exportIntent`. Its resolved image/SVG/video capabilities must correspond exactly to typed schema actions, applicable settings sections, and artifact acceptance. Use `core/setup-export.md` for the authoritative modes, evidence requirements, and decision sequence.
+
+Motion references declare typed `referenceInputs` before implementation; each behavior maps bidirectionally to observable acceptance and browser `reference-parity`. The canonical preprocessing, sampling, evidence, timing, and no-reference rules live in `core/reference-study.md`. Animated products declare `animationIntent`, and playback/keyframe timeline apps declare a proven loop duration when known. Detailed animation rules live in `core/timeline-animation.md`.
 
 ## Export And Actions
 
-Product apps expose delivery through sticky `panelActions`, not canvas UI or ordinary body controls. Every product exposes `Export PNG`; products whose requested delivery includes animation also expose `Export Video`. A playback or keyframe timeline may drive interactive preview without inventing video delivery.
+Product apps expose enabled artifact delivery through sticky `panelActions`, not canvas UI or ordinary body controls. `productReadiness.exportIntent` is required: image export defaults on and is absent only with explicit removal evidence; SVG/video exist only with explicit user-request evidence. Renderer technology, animation, playback, keyframes, and timeline presence never change that intent.
 
-Every app with `Export PNG` includes `Image Export` controls with `export.image.format` and `export.image.resolution`. Apps with `Export Video` also include `Video Export` controls with `export.video.format` and `export.video.resolution`.
+Every app with `Export PNG` includes `Image Export` controls with `export.image.format` and `export.image.resolution`. Apps with `Export Video` include `Video Export` controls with `export.video.format` and `export.video.resolution`. `Export SVG` has no settings section and joins the sticky actions without changing image/video settings adjacency. Resolved layouts must match `core/setup-export.md` exactly.
 
-Use the standard runtime path: declare typed `export-image`/`export-video` panel actions and their settings, provide one `ToolcraftAppComposition.exportRenderer` when product code contributes pixels, and draw one deterministic frame from the supplied state/time in scene coordinates. Call `shouldIncludeToolcraftPreviewBackground(state)` only for bounded live preview; runtime owns artifact composition, sizing, encoding, download, progress, and errors.
+Use the standard runtime path: declare typed `export-image`/`export-video` actions plus their settings and provide `ToolcraftAppComposition.exportRenderer` when product code contributes pixels. For explicit SVG delivery, declare `export-svg` and provide `svgExportRenderer`, which appends namespace-aware editable vector nodes to the supplied detached group. Call `shouldIncludeToolcraftPreviewBackground(state)` only for bounded live preview; runtime owns artifact composition, frame/sizing, SVG validation/serialization, raster/video encoding, download, progress, and errors.
 
 Detailed Setup, Background, Image Export, Video Export, sticky action, icon, and progress rules live in `core/setup-export.md`.
 

package/templates/starter/docs/toolcraft/workflow.md

@@ -1,6 +1,6 @@
 # Toolcraft Workflow
 
-<!-- toolcraft-performance-lifecycle: first-delivery=functional; later-delivery=functional-targeted; complaint=one-authority-targeted-performance-iteration; full-audit=explicit-only -->
+<!-- toolcraft-performance-lifecycle: first-delivery=functional-complete; later-edits=focused-only; complaint=one-authority-targeted-performance-iteration; full-audit=explicit-only -->
 <!-- toolcraft-performance-iteration: authority=exact-request-evidence+canonical-path-ids; fixture=reachable-development; after-pass=return-app-to-user+stop -->
 <!-- toolcraft-performance-full-authority: automatic=forbidden; recommendation=two-compatible-iterations-or-broad-unlocalizable-problem; command=pnpm verify:perf; authority=explicit-user-request-or-accepted-offer -->
 <!-- toolcraft-performance-routing: localized=agent-targeted; ambiguous=one-user-facing-choice; broad=offer-targeted-or-full; full=explicit-only -->
@@ -18,11 +18,11 @@ Before planning or editing app code, runtime code, controls, canvas, panels, ren
    - **Runtime/template source**: use root `AGENTS.md` and runtime contracts.
 3. Classify the task type.
 4. Read the task-specific docs below.
-5. Record the coherent user-visible delivery batch and its focused development checks before implementation.
+5. Record whether this is first product delivery or later feature work, plus its focused development checks, before implementation.
 
 Do not edit implementation files until this preflight is complete.
 
-Renderer and performance work also completes this pre-code sequence: reachable controls and inputs; workload dimensions and enforced boundaries; pass cost, frequency, lifecycle, and invalidation; render-plan assessment and protected kernel benchmark when required; derived paths and combined fixtures. Keep `src/app/app-verification-impact.json` current while implementing. Development uses impact-derived functional and browser checks without minting delivery evidence. First and later functional delivery run no measured performance; only exact request authority creates one targeted iteration. Full certification is a separate operator/CI action described in the canonical performance docs.
+Renderer and performance work also completes this pre-code sequence: reachable controls and inputs; workload dimensions and enforced boundaries; pass cost, frequency, lifecycle, and invalidation; render-plan assessment and protected kernel benchmark when required; derived paths and combined fixtures. Development uses feature-focused functional and browser checks without minting delivery evidence. First delivery runs no measured performance; only exact request authority creates one targeted iteration. Full certification is a separate operator/CI action described in the canonical performance docs.
 
 ## Local Contract Authority
 
@@ -64,14 +64,14 @@ For product app work, update `docs/toolcraft/agent-worklog.md` before reporting
   - decision;
   - alternatives rejected;
   - state/output mapping from controls, commands, timeline, layers, media, or renderer to the visible product;
-  - one bare-delivery verification narrative;
+  - first-delivery proof or later focused-check narrative;
   - risks or follow-ups.
 - for localized performance work, or a post-clarification targeted choice, an exact request quote and the canonical affected performance path IDs; classifier output establishes complaint authority only, and unresolved localization records neither performance-iteration intent nor canonical path authority regardless of classifier result.
 - updated high-level decisions for renderer, view interaction, interaction ownership, timeline, layers, controls, export, and performance when those choices change.
 
 If the folder is still the neutral starter, do not invent product decisions. Once it becomes a product, switch the worklog to product mode and keep it concrete.
 
-Protected receipts, not the worklog, own changed files, the derived plan, executed checks, reports, measurements, and pass/fail evidence. Each Decision Trail entry mentions only that one bare `pnpm verify:delivery` will derive and run the protected proof.
+Protected receipts own first-delivery and performance proof. The worklog records which focused tests and browser checks were selected for later edits; those edits do not create another functional receipt.
 
 ## Runtime Boundary
 
@@ -92,26 +92,26 @@ Browser verification is outcome-based. Protected helpers attach versioned eviden
 The normal product loop is:
 
 ```text
-assemble/change
+assemble first product
 → focused functional feedback
-→ one coherent delivery boundary
-→ protected functional delivery
+→ one protected initial delivery
+→ later edits with feature-focused checks only
 → user evaluation
 ```
 
-Use the smallest focused unit and browser checks while implementation is changing. Do not rerun the aggregate, export, or performance matrix after every edit. At the coherent delivery boundary, run one bare `pnpm verify:delivery` and use the automatic sequence:
+Use the smallest focused unit and browser checks while implementation is changing. Do not rerun the aggregate, export, or performance matrix after edits. Use this automatic sequence:
 
 1. **First product delivery:** bare `pnpm verify:delivery` proves complete product contracts, performs one production build, runs full functional acceptance, and runs no measured performance.
-2. **Later functional-targeted delivery:** bare `pnpm verify:delivery` compares the immediate previous and current semantic functional proof models. It selects exact changed acceptance contracts, their direct owners and domains, and tests reached through the affected product-unit dependency graph.
-3. **Localized or clarified targeted work:** only a localized complaint or a post-clarification targeted choice records domain authority in the worklog—an exact request quote plus canonical affected path IDs—and runs one bare `pnpm verify:delivery`. It executes one targeted iteration against the reachable development fixture, returns the verified app, and waits for user evaluation. Classifier output alone never localizes a path; unresolved localization creates neither performance-iteration intent nor canonical path authority, whether classification returned high-confidence `performance-iteration` or `needs-agent-judgment`.
-4. **Full audit:** only an explicit operator request or accepted offer authorizes `pnpm verify:perf`. It performs one fresh build and the complete maximum-fixture performance matrix without advancing the delivery anchor.
+2. **Later ordinary edits:** run the exact unit/component test for the changed implementation, then `pnpm test:feature -- <acceptance-id>`. The feature command resolves current product acceptance only. A leaf ID runs one browser scenario; a finite selector automatically includes acceptance peers whose applicability cases depend on it. Multiple changed behaviors use multiple explicit IDs. Use `pnpm test:feature -- --all` only when a cross-cutting functional edit cannot be honestly bounded; `--all` still means all product acceptance, not all Playwright tests. The command runs current source through the development server and never runs build, delivery, export matrices, framework self-tests, or measured performance. Commit, push, deploy, preview, steering, and fixes do not authorize aggregate proof. A repeated bare `pnpm verify:delivery` is a protected no-op that exits before inventory, build, tests, export, and performance work and preserves the initial receipt byte-for-byte.
+3. **Localized or clarified targeted performance work:** only a localized complaint or a post-clarification targeted choice records domain authority in the worklog—an exact request quote plus canonical affected path IDs—and runs one bare `pnpm verify:delivery`. It executes one targeted iteration against the reachable development fixture, returns the verified app, and waits for user evaluation. Classifier output alone never localizes a path; unresolved localization creates neither performance-iteration intent nor canonical path authority, whether classification returned high-confidence `performance-iteration` or `needs-agent-judgment`.
+4. **Full audit:** only an explicit operator request or accepted offer authorizes `pnpm verify:perf`. It performs one fresh build and the complete maximum-fixture performance matrix without replacing the initial delivery receipt.
 
 Performance authority and localization are separate decisions. Classifier output establishes complaint authority only and never path localization. A localized complaint lets the agent select the affected canonical paths and run one targeted iteration without asking the user. For an ambiguous complaint, ask one user-facing question that names the visible operation and offers targeted diagnosis or a complete performance review; never ask the user to choose internal path IDs, and record no performance-iteration intent or canonical path authority before the answer. For a broad or honestly unlocalizable problem, the agent may recommend the complete performance review in that single targeted/full choice, but the user still chooses. A direct request for the complete performance review runs `pnpm verify:perf` without another clarification.
 
 Store agent-produced browser diagnostics under `.toolcraft/browser-artifacts/`. Browser integrations may instead use their external tool-owned storage; diagnostic files never belong in product source.
 
-The unchanged `sourceHash` fast path does not collect the catalog, dependency graph, or functional proof model and does not execute proof. For a changed source, the current catalog, input roles, ownership inventory, and semantic model are collected once and remain the immutable basis for that delivery plan. `workflow-observation.md` is a post-delivery summary, not execution authority, so it stays outside this hash; `agent-worklog.md` remains included.
+The proven-product phase guard runs before current-source inventory, integrity, build, tests, or semantic proof collection. The initial receipt remains the durable first-version identity even after later source edits. `workflow-observation.md` is a post-delivery summary, not execution authority; `agent-worklog.md` remains part of first-delivery inputs.
 
 After two consecutive compatible targeted iterations, offer the slower full audit if the user remains unsatisfied. A complaint, filename, or touched subsystem never authorizes it. Canonical classification details, failure behavior, and evidence wording live in `core/performance.md` and `performance.md`.
 
-The app is not complete when required checks are failed, incomplete, pending, blocked, or listed as skipped. Resolve benchmark requirements with the protected internal kernel check before accepting the renderer. The delivery runner executes integrity and lifecycle-specific proof atomically, binds evidence to current source, and advances the delivery anchor only after success. Product prose and command arguments cannot select or broaden that proof.
+The first product version is not complete when its required checks are failed, incomplete, pending, blocked, or listed as skipped. Later work is not complete until its directly relevant focused checks pass. Resolve benchmark requirements with the protected internal kernel check before accepting the renderer. The delivery runner executes initial or authority-backed performance proof atomically; ordinary later edits do not advance or replace the initial receipt. Product prose and command arguments cannot select or broaden performance proof.

package/templates/starter/e2e/app-browser-control-applicability-requirements.spec.ts

@@ -0,0 +1,163 @@
+import { expect, test } from "@playwright/test";
+import { defineToolcraft } from "@repo/toolcraft-runtime";
+
+import { deriveToolcraftBrowserRuntimeRequirements } from "./browser-runtime-evidence-requirements";
+
+const inventory = [
+  {
+    entity: "Feature",
+    entityId: "feature",
+    groupingReason: "Mode and amount describe one feature.",
+    id: "feature",
+    targets: ["feature.mode", "feature.amount"],
+    title: "Feature",
+  },
+] as const;
+
+test("conditional controls derive case-specific visibility and outcome evidence", () => {
+  const schema = defineToolcraft({
+    canvas: { enabled: true },
+    panels: {
+      controls: {
+        sections: [
+          {
+            controls: {
+              amount: {
+                applicability: {
+                  all: [{ equals: "advanced", target: "feature.mode" }],
+                  mode: "conditional",
+                },
+                defaultValue: 1,
+                target: "feature.amount",
+                type: "slider",
+              },
+              mode: {
+                applicability: { mode: "always" },
+                defaultValue: "simple",
+                options: [
+                  { label: "Simple", value: "simple" },
+                  { label: "Advanced", value: "advanced" },
+                ],
+                target: "feature.mode",
+                type: "segmented",
+              },
+            },
+            id: "feature",
+            title: "Feature",
+          },
+        ],
+        title: "Controls",
+      },
+    },
+  });
+  const requirements = deriveToolcraftBrowserRuntimeRequirements(
+    [
+      {
+        browser: true,
+        browserTestName: "browser: conditional amount",
+        evidence: "product-output",
+        id: "feature.amount",
+        kind: "control",
+        target: "feature.amount",
+      },
+    ],
+    schema,
+    inventory,
+  );
+
+  expect(requirements.map(({ evidenceType }) => evidenceType)).toEqual(
+    expect.arrayContaining([
+      "control-applicability-hidden",
+      "control-applicability-visible",
+      "product-observable-change",
+    ]),
+  );
+  expect(
+    requirements.some(
+      (requirement) => requirement.requirementId === "feature.amount",
+    ),
+  ).toBe(false);
+});
+
+test("finite siblings expand outcomes even when always-applicability omits the selector", () => {
+  const schema = defineToolcraft({
+    canvas: { enabled: true },
+    panels: {
+      controls: {
+        sections: [
+          {
+            controls: {
+              amount: {
+                applicability: { mode: "always" },
+                defaultValue: 1,
+                target: "feature.amount",
+                type: "slider",
+              },
+              mode: {
+                applicability: { mode: "always" },
+                defaultValue: "simple",
+                options: [
+                  { label: "Simple", value: "simple" },
+                  { label: "Advanced", value: "advanced" },
+                ],
+                target: "feature.mode",
+                type: "segmented",
+              },
+            },
+            id: "feature",
+            title: "Feature",
+          },
+        ],
+        title: "Controls",
+      },
+    },
+  });
+  const acceptance = {
+    browser: true,
+    browserTestName: "browser: feature amount",
+    evidence: "product-output" as const,
+    id: "feature.amount",
+    kind: "control" as const,
+    target: "feature.amount",
+  };
+  const requirements = deriveToolcraftBrowserRuntimeRequirements(
+    [acceptance],
+    schema,
+    inventory,
+  );
+
+  expect(requirements).toHaveLength(4);
+  expect(
+    requirements.filter(
+      ({ evidenceType }) => evidenceType === "control-applicability-visible",
+    ),
+  ).toHaveLength(2);
+  expect(
+    requirements.filter(
+      ({ evidenceType }) => evidenceType === "product-observable-change",
+    ),
+  ).toHaveLength(2);
+  expect(
+    requirements.every(({ requirementId }) =>
+      requirementId.includes("#applicability:feature.mode="),
+    ),
+  ).toBe(true);
+
+  expect(() =>
+    deriveToolcraftBrowserRuntimeRequirements(
+      [
+        {
+          ...acceptance,
+          renderScaleCoverage: {
+            kind: "selected-backing-pixels",
+            states: [],
+          },
+        },
+      ],
+      schema,
+      inventory,
+    ),
+  ).toThrow(
+    "Visible applicability case for feature.amount has no product outcome requirement",
+  );
+});

package/templates/starter/e2e/app-browser-infinity-canvas-evidence.spec.ts

@@ -6,6 +6,9 @@ import {
   expectToolcraftInfinityCanvasVideoExportEvidence,
   observeInfinityCanvas,
 } from "./browser-infinity-canvas-evidence";
+import { expectToolcraftInfinityCanvasSvgExportEvidence } from "./browser-infinity-canvas-svg-evidence";
+import { createToolcraftSvgFixtureDownload } from "./svg-download-test-fixtures";
+import { inspectToolcraftSvgDownload } from "./svg-artifact-inspection";
 import {
   readToolcraftCanvasViewport,
   zoomToolcraftCanvasViewport,
@@ -17,13 +20,18 @@ test("toolcraft Infinity canvas observation reads runtime-owned geometry", async
   await page.setContent(`
     <div data-toolcraft-canvas-world data-toolcraft-canvas-offset-x="12" data-toolcraft-canvas-offset-y="-8">
       <div data-toolcraft-canvas-mode="infinite" style="overflow: visible">
-        <div data-scene style="position:absolute;left:-320px;top:-200px;width:640px;height:400px"></div>
+        <div data-scene style="position:absolute;left:1px;top:2px;width:3px;height:4px"></div>
+        <div
+          data-toolcraft-product-scene
+          data-toolcraft-product-scene-status="ready"
+          style="position:absolute;left:-320px;top:-200px;width:640px;height:400px"
+        ></div>
       </div>
     </div>
   `);
 
   expectInfiniteCanvasObservation(
-    await observeInfinityCanvas(page, "[data-scene]"),
+    await observeInfinityCanvas(page),
     { height: 400, width: 640, x: -320, y: -200 },
   );
 });
@@ -91,6 +99,41 @@ test("toolcraft Infinity canvas video evidence compares decoded envelopes", asyn
   );
 });
 
+test("toolcraft Infinity canvas SVG evidence compares inspected vector envelopes", async ({
+  page,
+}) => {
+  const source = (width: number, height: number, x: number, y: number) =>
+    `<svg xmlns="http://www.w3.org/2000/svg" width="${width}" height="${height}" viewBox="${x} ${y} ${width} ${height}"><g data-toolcraft-product-scene="true"><rect data-shape="true" x="${x}" y="${y}" width="${width}" height="${height}" fill="#52AAFF"/></g></svg>`;
+  const finite = await inspectToolcraftSvgDownload({
+    download: await createToolcraftSvgFixtureDownload(
+      page,
+      source(1080, 1350, 0, 0),
+      "finite.svg",
+    ),
+    page,
+  });
+  const infinite = await inspectToolcraftSvgDownload({
+    download: await createToolcraftSvgFixtureDownload(
+      page,
+      source(640, 400, -320, -200),
+      "infinite.svg",
+    ),
+    page,
+  });
+  await expectToolcraftInfinityCanvasSvgExportEvidence(
+    {
+      finite: finite.inspection,
+      infinite: infinite.inspection,
+    },
+    {
+      expectedFiniteSize: { height: 1350, width: 1080 },
+      expectedInfiniteSize: { height: 400, width: 640 },
+      requirementId: "fixture.infinity.svg",
+      target: "canvas.infinity",
+    },
+  );
+});
+
 test("toolcraft Infinity canvas background evidence proves viewport color and dependency", async () => {
   await expectToolcraftInfinityCanvasBackgroundEvidence(
     {