@reqvire-org/ads 0.3.2 → 0.3.5

package/docs/ARCHITECTURE.md

@@ -149,6 +149,33 @@ preserving compatible consumer APIs. Markup, accessibility, events, layout, and
 motion still need verification when an implementation changes. Imported or
 adapted source carries its credits and applicable notices in its local guide.
 
+## Controllers own reusable behavior
+
+A private controller stays beside its component or pattern. Shared behavior uses
+`controllers/<Name>/` as an independent edit owner. Controllers may be plain
+functions/classes, framework hooks or context providers; sharing code does not
+implicitly share instances. Use the configured framework and declared project
+dependencies, with no runtime supplied by the MCP host. Shared controllers do not
+import styled consumers or introduce another skin layer. Existing measurement and
+style-write boundaries still apply.
+
+Optional owner-local `behavior.json` contracts identify public APIs or private
+source/symbols, named guarantees and registered execution checks. Scenario
+`exercises` links public behavior APIs to reachable demonstrations; `covers`
+continues to describe rendered public UI. Controllers need no artificial standalone
+visual scenario. Static registration is separate from current passing evidence.
+
+Manifests, checks, scenarios and fixtures are development inputs; production
+imports only actual components/controllers and their styles. Browser checks can
+exercise the real MCP App. React development StrictMode uses a project development
+harness, since production previews do not replay those effects. The
+[behavior contract](BEHAVIORS.md) defines profiles, execution and evidence freshness.
+
+The normal compiled import graph delivers controller dependencies through MCP
+resources. There is no eager global controller registry. ESM splitting and selected
+asset loading remain in place; tree shaking depends on actual imports, exports and
+side effects, rather than the controller directory name.
+
 ## The showcase is the shared design workspace
 
 Humans and coding agents inspect the same project through MCP. The showcase is
@@ -222,6 +249,8 @@ real public implementation. It mounts independently, without opening a showcase
 page or initializing the application's router, store or services first.
 
 Scenarios and their fixtures live beside the tokens, component or pattern they exercise.
+Demo framing belongs to public review/layout patterns; component props describe
+intentional product behavior and visual variants.
 Token scenarios choose real token names and sample inputs; a project-owned
 review pattern applies the foundation variables. The tool contains no project
 token list, sample templates or assumed visual identity. Even an initial token
@@ -287,11 +316,22 @@ Bounded tools establish what exists; explicit resource reads provide detail.
 Prompts and packaged skills explain how to reason through Data, UX and Skin and
 how to inspect the real implementation before changing it.
 
+The MCP runtime owns its browser hosts and preview builder lifetime. Closing the
+client connection releases them together; a separate ownership guard can stop
+detached builders after abrupt owner death. A preview process must not outlive
+its owner and continue publishing stale output.
+Build reports expose queued, validation, compilation and publication progress.
+A timed-out preview request marks the builder stalled; the next explicit request
+restarts it within the same MCP session. A running process alone is not freshness.
+
 Opt-in MCP editing makes validation part of the write operation. The agent sends
 a Git unified diff for one logical ADS unit: its implementation and owned preview
 context, or the shared token foundation. ADS resolves file ownership, reconstructs
 candidate files locally and validates a temporary project copy with architecture
-checks, registered lint rules and project validation scripts. This keeps edits
+checks, registered lint rules and project validation scripts. Affected registered
+behavior checks, including consumers of a changed shared controller, also run in
+the isolated candidate project. Passing checks describe
+their registered assertions, not every natural-language claim. This keeps edits
 focused without requiring entire file bodies in model context. Peer units and
 unrelated owners remain outside the selected unit's edit boundary. Shared foundation,
 branding and guides have their own units. Project configuration, registered guards
@@ -303,9 +343,10 @@ remain in place for source changes made through other editors; preview review re
 necessary after either editing path.
 
 Required shared-entry bookkeeping can accompany its owner: component/pattern
-re-exports and canonical foundation imports for token files created or deleted in
-the same patch. ADS restricts these companion edits and validates the complete
-candidate before writing, so coupled changes do not need a guard bypass.
+re-exports, canonical foundation imports for token files created or deleted, and
+only that owner’s style-boundary entries in project configuration in the same
+patch. ADS restricts these companion edits and validates the complete candidate
+before writing, so coupled changes do not need a guard bypass.
 
 The architecture makes that inspection practical. A public export has an owning
 source and addressable preview coverage. Token definitions expose its visual

package/docs/BEHAVIORS.md

@@ -0,0 +1,230 @@
+# Controllers and behavioral verification
+
+Controllers own reusable UI behavior: state, subscriptions, DOM measurements and
+lifecycle coordination. A controller may be a class, function, hook, state
+machine or context provider. Linaria and tokens own its consumers' visual design.
+
+Private controllers stay inside their component/pattern mutation unit. Shared
+controllers use `design-system/controllers/<Name>/` with an `index` entry or a
+runtime file matching the directory name. The unit ID is `controllers/<Name>`.
+Its implementation, tests and guides can change together, including only its own
+required public re-exports. A shared controller needs no artificial visual preview.
+Consumers normally create separate instances; sharing implementation does not
+implicitly share state.
+
+Use the project's `framework` from `ds.config.json` for framework-specific APIs.
+Plain TypeScript, browser APIs and local behavior helpers remain supported.
+Declare external dependencies in the project package. ADS does not install them
+or assume a renderer/library supplied by an MCP host. The framework field selects
+compilation/mounting; controller checks also validate runtime imports. Type-only
+UI references are allowed, but shared controllers cannot import component/pattern
+runtime implementations. Keep business data in application adapters. Measured
+style writes retain exact `boundaries.styleWrites` properties; they do not allow
+shared-token overrides or an extra styling layer.
+These gates inspect supported direct imports, markup and style boundaries.
+External package internals and delegated DOM behavior still require source,
+build and browser review; declaring a dependency does not prove it is headless.
+
+## Development boundary
+
+Production includes real components, controllers, tokens and compiled styles.
+Scenarios and fixtures are included only in previews. Behavior manifests and test
+files are development/tooling inputs. Runtime imports and public re-exports of
+those inputs are rejected, including dynamic imports and aliases.
+
+## Register guarantees
+
+An optional `behavior.json` belongs to one directory unit. Flat units use
+`<Owner>.behavior.json`. Existing projects without manifests remain valid and have
+no implied behavioral verification. A manifest is declarative and contains no
+executable command:
+
+```json
+{
+  "schemaVersion": 1,
+  "subjects": {
+    "controller": { "source": "./scroller-controller.ts", "symbol": "ScrollerController" },
+    "scroll-api": { "api": "useMessageScroller" }
+  },
+  "guarantees": [
+    {
+      "id": "prepend-anchor",
+      "description": "Prepending history preserves the visible anchor after layout settles.",
+      "subjects": ["controller", "scroll-api"],
+      "checks": ["prepend-anchor"]
+    }
+  ],
+  "checks": {
+    "prepend-anchor": {
+      "file": "./behavior.spec.ts",
+      "case": "prepend-anchor",
+      "scenario": "components/MessageScroller",
+      "profile": "widget"
+    }
+  }
+}
+```
+
+Names above are illustrative project choices. A subject identifies a public export
+through `api`, or an owner-local implementation `source` with an optional top-level
+`symbol`. Private subjects do not become public API. A guarantee references known
+subjects and checks. Each check names an owner-local test/spec file, stable case
+ID, registered profile and optional discovered scenario. Several guarantees may
+reference one check. Repeated execution identities use the same check ID.
+
+Static validation establishes registration and ownership, not that the guarantee
+is true. README prose is not automatically certified. Link specific guarantees
+when describing the evidence available for a behavior.
+
+## Link a public API to a demonstration
+
+Scenario `covers` retains its existing render-reference contract. Optional
+`exercises` identifies public behavioral APIs:
+
+```tsx
+export const scenario = {
+  title: "Message scrolling",
+  covers: ["MessageScroller", "MessageScrollerViewport"],
+  exercises: ["useMessageScroller", "useMessageScrollerScrollable"],
+};
+```
+
+Call hooks in a rendered local scenario adapter. Calls/construction are matched by
+resolved symbol, not a `use*` naming convention. An unused import, dead adapter or
+metadata string does not count. Dynamically passed behavior references produce a
+review advisory when a direct call cannot be established; verify those through
+registered execution checks rather than changing the API for the analyzer.
+
+Public APIs appear in `ads_catalog` with `apiKind: "ui"` or `"behavior"` and their
+scenario links. `ads_behaviors` joins contracts to demonstrations and evidence.
+A demonstrated API is not automatically a verified guarantee.
+
+## Register execution profiles
+
+Profiles are explicit trusted development commands in `ds.config.json`. They use
+literal executable/argument arrays, no shell interpolation or model-supplied
+command. For a project with an installed Playwright test runner:
+
+```json
+{
+  "mcp": {
+    "behaviorProfiles": {
+      "widget": {
+        "runner": "playwright",
+        "command": "npm",
+        "args": ["run", "test:behavior", "--"],
+        "mode": "browser",
+        "timeoutMs": 60000
+      }
+    }
+  }
+}
+```
+
+Here `test:behavior` invokes the project's local `playwright test`. Its Playwright
+configuration must discover colocated spec files. Configure browser installation
+and any required test setup in that project. The ADS tooling host gains no
+framework or browser dependency from a profile.
+
+The Playwright adapter appends selected file paths, its reporter and a generated
+artifact directory. Use native test tags for stable case identity:
+
+```ts
+import { test, expect } from "@playwright/test";
+import { openBehaviorScenario } from "@reqvire-org/ads/verification";
+
+test("history preserves the visible anchor", { tag: "@ads:prepend-anchor" }, async ({ page }) => {
+  const frame = await openBehaviorScenario(page, "prepend-anchor");
+  // Perform real interactions and assert the project's guarantee here.
+  await expect(frame.getByRole("region", { name: "Messages" })).toBeVisible();
+});
+```
+
+The shown assertion is only a harness example; it does not establish anchoring.
+Write meaningful assertions for the registered guarantee. The helper waits for
+the current selected scenario inside the real sandboxed MCP App. It uses `load`
+and explicit readiness, not `networkidle`: MCP keeps event connections open.
+
+`mode: "browser"` starts an isolated managed showcase on an automatic port. Test
+requests contain its scenario URLs, and cleanup closes its host/compiler tree.
+Mutation candidates use their own source, generated graph and server; a passing
+test against an older fixed-port live showcase cannot validate a candidate.
+
+Use `mode: "strict"` only for React with a project development harness that mounts
+the relevant API in StrictMode. The production MCP App does not replay development
+effects. This profile does not receive a production showcase URL from the helper.
+For Preact, register its actual lifecycle tests without claiming React StrictMode.
+The profile names record the chosen environment; ADS does not infer that a test's
+assertions cover every lifecycle condition.
+
+Other runners use `runner: "protocol"` (the default). ADS provides
+`ADS_VERIFY_REQUEST` and `ADS_VERIFY_REPORT` absolute paths. Read the request's
+`schemaVersion`, unique `runId`, `projectRoot`, `framework`, `profile`, `mode`,
+selected `checks` and optional `scenarios` URLs. Write a bounded JSON report:
+
+```json
+{
+  "schemaVersion": 1,
+  "runId": "<the request's runId>",
+  "cases": [
+    {
+      "id": "prepend-anchor",
+      "file": "design-system/components/MessageScroller/behavior.spec.ts",
+      "status": "passed"
+    }
+  ]
+}
+```
+
+Case statuses are `passed`, `failed` or `skipped`, with optional `message`.
+`file` is project-relative. Nonzero process exit, missing cases, skipped cases,
+wrong run IDs and unavailable reports do not pass. Test commands are trusted
+project code; an adapter cannot prove the quality or honesty of their assertions.
+
+## Execute and inspect evidence
+
+Use `ads_behaviors` for bounded discovery; request an exact unit for its contract.
+General listings return counts and short API/guarantee/scenario summaries. Exact
+owner requests return the registered details; source reads remain available for
+bounded inspection of large contracts. No full guide or test body is injected
+into discovery results.
+Call `ads_verify({unit, checks?})` for selected registered checks. Read
+`ads://project/behaviors` for current evidence or `ads://guides/behaviors` for this
+guide. CLI/CI equivalents are:
+
+```sh
+ads behaviors . --json
+ads verify . --unit controllers/ScrollFollow
+ads verify . --unit components/MessageScroller --check prepend-anchor --json
+```
+
+Execution has bounded output, a configured timeout, cancellation and process-tree
+ownership. Evidence records case/profile identity, source/dependency revision,
+completion time, report path and the available preview revision. Later input
+changes mark results stale; changes during execution prevent a current pass.
+Guarantees report passing only when all their checks have current passing evidence.
+Passing applies to those cases and profiles, not every application state.
+
+Revisions include owned files, literal import dependencies, local CSS imports and
+asset URLs, token foundation, project/runner configuration, lockfiles and tooling.
+Computed module selection conservatively includes all ADS owners. Environment,
+network and other unregistered external inputs remain the runner's responsibility;
+an evidence record is not a proof about arbitrary external state.
+
+Guarded mutations execute affected registered behavior contracts after core,
+Oxlint and configured project checks, before writing source. Imported shared
+controller changes also select dependent contracts conservatively. Rejected and
+dry-run patches publish no source changes. Verification output stays under `.ds/`.
+
+## Packaging and performance
+
+Controllers follow normal component/scenario imports into the project's compiled
+resource graph. Their framework dependencies are bundled by the project compiler
+and served through MCP resources inside the App iframe; external hosts install
+nothing. The selected scenario loads its dependency closure. Shared modules are
+cached within that App instance, and each separately opened App has its own runtime.
+
+Keep ESM modules and explicit imports. Avoid an eagerly imported controller
+registry. Tree shaking and shared chunks follow the project bundler: class methods,
+side effects, global CSS and dynamic maps can retain extra code. Inspect emitted
+resources instead of assuming a controller produces a minimal bundle.

package/docs/CHANGELOG.md

@@ -1,5 +1,53 @@
 # Changelog
 
+## Unreleased
+
+## 0.3.5
+
+- Bound preview-watch test teardown, publish selection requests atomically and
+  wait for the changed preview output before checking revision/queue order.
+  Cap the release test stage so failed cleanup cannot hold publication indefinitely.
+
+- Stabilize the development StrictMode browser harness across dependency-optimizer
+  reloads. Verify the broken controller fails its cleanup assertion and the
+  repaired controller passes. Version 0.3.4 was not published after CI caught the
+  harness navigation race.
+
+- Add shared controller units, framework/dependency and headless ownership checks,
+  while retaining private controllers in their consumers' units.
+- Add optional owner-local behavior contracts, scenario `exercises`, public hook
+  discovery, `ads_behaviors`/`ads_verify`, revision-bound results and subscribed
+  evidence resources. Guarded edits run affected registered checks in candidates.
+- Add registered protocol/Playwright execution profiles with cancellation,
+  process-tree cleanup, real sandboxed-App checks and development StrictMode
+  harness guidance. Keep behavior metadata/tests outside production imports.
+- Rename the external-library adaptation workflow and MCP prompt to `ads-migrate`;
+  retain `ads-import` for ADS-compatible source and token transfers.
+- Expose compiler progress phases and restart a timed-out builder on the next
+  explicit preview request without requiring an MCP reconnect.
+
+- Close the raw `ch` sizing gap across absolute/font-relative CSS length units,
+  nested calculations and numeric notation. Share unit categories with dimension
+  token validation; keep structural angles and responsive geometry available.
+  Preserve the demo's text measures in owned tokens with preview coverage.
+
+- Close the whole MCP runtime on stdio wire closure, including broken output,
+  and stop browser sockets, subscriptions and preview processes together.
+- Add an independent preview ownership guard so abrupt MCP process or process-group
+  death also terminates detached builders and their descendants.
+
+## 0.3.3
+
+- Reject unused inline-style permissions and imperative property permissions.
+  Allow only the edited owner's boundary entries to accompany its source patch
+  atomically; preserve other settings and peer permissions.
+- Keep directory unit ownership stable when removing an optional standalone
+  scenario; require actual coverage from remaining entries.
+- Expose nonblocking pointer-capture cleanup advisories in CLI, MCP checks and
+  accepted mutations. Keep delegated cleanup and runtime correctness under review.
+- Clarify demo framing, intentional product APIs and local asset fixtures in
+  diagnostics and skills; preserve component capabilities without demo-only props.
+
 ## 0.3.2
 
 - Enforce foundation CSS roles, parsed selector boundaries, root-only shared token

package/docs/GUIDE.md

@@ -29,6 +29,20 @@ template strings and Shadow DOM style constructs lack equivalent coverage.
 Retain framework-specific checks; a clean ADS check does not validate those
 unchecked surfaces.
 
+### Controllers and behavior checks
+
+Keep private controllers with their consumer; share reusable behavior through
+`design-system/controllers/<Name>/`. Use the configured framework and declared
+project dependencies. Controllers own lifecycle/measurements while components and
+patterns own presentation. A shared context provider is a behavioral API too.
+
+Optional owner-local `behavior.json` registers guarantees and maintained checks.
+Scenario `exercises` records demonstrations separately from rendered `covers`.
+Use `ads behaviors --json` for discovery and `ads verify --unit <discovered-id>`
+to run registered cases; MCP exposes `ads_behaviors` and `ads_verify`. Tests and
+contracts stay outside production exports. See the [complete schema and runner
+integration](BEHAVIORS.md), including browser and React development StrictMode profiles.
+
 ### Linaria integration
 
 Before authoring components or patterns, integrate Linaria extraction with the
@@ -558,6 +572,7 @@ Application manifest metadata and other platform exports remain project-owned.
 | Asset ownership | ADS/public mount collisions, configured generated assets in source, and tracked generated output |
 | Product patterns | CSS/JSX namespace ownership; ADS implementations and showcase cannot import app source |
 | Primitive state | State-variable overrides outside components; undocumented non-state component variables |
+| Literal visual values | Absolute/font-relative lengths (including `ch` and root font units), durations and color/effect formulas require tokens; geometry angles and responsive viewport/container relationships remain available |
 | Fixed token ownership | Foreign token names, shared token overrides, misplaced component/pattern/showcase variables, and noncanonical foundation imports |
 | Showcase ownership | Fixture CSS/Linaria definitions, custom JSX classes, native controls/widget roles, state styling, private CSS/aliased imports, legacy catalogue dependencies and source ownership, and runtime imports of fixtures/test helpers |
 | Scenario coverage | All public renderable UI has path-discovered entries, colocated fixtures, literal metadata and reachable public render references; runtime imports of scenarios/fixtures are rejected |
@@ -689,6 +704,15 @@ Registered project configuration and build helpers may import one another;
 this boundary is derived when lint configuration is generated. It does not
 allow application code to import private ADS modules or build helpers to import
 private UI implementation.
+
+Unused `inlineStyleFiles` entries and `styleWrites` properties fail the core
+`stale-style-boundary` check. Inline permissions recognize JSX, imported UI
+factories and UI `CSSProperties` use; property permissions require an exact write
+or removal, not a read. For MCP migrations, include the owner's source and only
+its own exception entries through its `ds.config.json` companion. Preserve peer
+permissions and other settings. A future filename can be valid configuration,
+but the complete checked candidate must contain the matching use.
+
 `inlineStyleFiles` should name only documented geometry/renderer boundaries,
 not broad styling exceptions. Ignore `.ds/`; generated paths refer to the project
 and its locally installed tool.
@@ -708,7 +732,7 @@ Retain unrelated lint, type checking, and framework build commands.
 ## External content
 
 Use the repository's `ads-import` skill for selected external ADS source or theme
-values, and `ads-assimilate` for a native implementation inspired by an upstream
+values, and `ads-migrate` for a native implementation inspired by an upstream
 library. These agent workflows handle dependency closure, token mapping, motion
 comparisons, source credits, applicable notices, and local documentation.
 They are agent workflows, rather than CLI import/design subcommands. Install

package/docs/MCP.md

@@ -17,7 +17,11 @@ preview watcher and artifacts. Stdout remains exclusively JSON-RPC.
 
 For browser-only work, run `ads showcase` inside the project. It starts the same
 runtime without stdio. `--port 4185` selects a port; otherwise the OS chooses an
-available one. `ads mcp --no-showcase` disables the website for headless clients.
+available one. For a stable address, add `"--port", "4191"` to the server's `args`
+in `.mcp.json` (or the corresponding client configuration). An occupied explicit
+port fails startup; ADS does not silently switch ports or terminate another live
+client. Reuse the connected server's showcase instead of launching another one.
+`ads mcp --no-showcase` disables the website for headless clients.
 The website binds to 127.0.0.1 and accepts its own origin only. It serves packaged
 client assets and MCP, with no arbitrary file reader or command launcher.
 Shutdown closes both transports, subscriptions and the managed compiler.
@@ -155,7 +159,7 @@ The server supplies agent guidance through its instructions, tool descriptions,
 | Tool | Purpose |
 |------|---------|
 | `ads_status` | Project paths, watcher/build states, preview revisions and diagnostics, skills |
-| `ads_catalog` | Bounded search for real public components/patterns and source/guide URIs |
+| `ads_catalog` | Bounded search for public UI, controllers and hooks, with source/guide URIs |
 | `ads_tokens` | Bounded token-definition and theme inspection |
 | `ads_check` | Current core architectural diagnostics; registered Oxlint/build tests remain separate |
 | `ads_skills` | Workflow names/descriptions without loading instructions |
@@ -163,22 +167,50 @@ The server supplies agent guidance through its instructions, tool descriptions,
 | `ads_show_tokens` | Render a discovered token scenario; legacy compilers retain the definition inspector |
 | `ads_scenarios` | Bounded token/component/pattern/composition scenario discovery |
 | `ads_show_scenario` | Render an exact discovered scenario with its own fixtures |
+| `ads_behaviors` | Bounded guarantee/evidence discovery; pass an exact unit for contract details |
+| `ads_verify` | Execute an owner's registered checks and record revision-bound evidence |
 | `ads_show_<id>` | Optional explicitly configured grouped App |
 | `ads_units` | Discover edit owners and the files belonging to one unit |
 | `ads_read_file` | Read bounded source ranges, with owning unit and full-file digest |
 | `ads_apply_patch` | Opt-in Git unified diff for one ADS unit, with dry-run validation |
 
 Listings have bounded pages and opaque cursors. The source catalogue exposes
-public exports from `components/` and `patterns/`; it does not execute TSX to
+public exports from `components/`, `patterns/` and `controllers/`; it does not execute TSX to
 guess component props. Read the exported API and owning guide. An export name
 alone does not prove that a preview renders that particular element.
 
-`ads://project/status`, `/build`, `/tokens`, `/catalog`, `/scenarios`, and `/checks` carry complete JSON
+`ads://project/status`, `/build`, `/tokens`, `/catalog`, `/scenarios`, `/behaviors`, and `/checks` carry complete JSON
 detail. Allowed project documentation/source and skill files are separate
 resources. No arbitrary filesystem reader is exposed. Prefer bounded tools for
 large catalogues; explicit resource reads can enter model context and a client
 may truncate large payloads.
 
+### Behavioral verification
+
+Read `ads://guides/behaviors` or the [behavior guide](BEHAVIORS.md) for the contract
+and runner schema. `ads_behaviors({ "unit": "components/MessageScroller" })`
+returns subjects, guarantees, demonstration links and check IDs for a discovered
+owner. `ads_verify({ "unit": "components/MessageScroller", "checks": ["prepend-anchor"] })`
+runs those registered cases. The names here are examples, never built-in cases.
+
+`covers` describes rendered UI; optional `exercises` describes public behavioral
+APIs used through reachable scenario code. Neither metadata nor README prose is
+passing evidence. Verification runs trusted project commands from configured
+profiles, without installing dependencies. It is available in read-only source
+mode too and is annotated as executing commands/writing generated evidence.
+Missing/skipped cases, unavailable runners and changed inputs cannot pass.
+Results and subscribed resource notifications are available through
+`ads://project/behaviors`; explicitly re-read evidence when notifications are absent.
+
+Browser profiles start an isolated showcase and verify its sandboxed App using
+the selected candidate's sources. StrictMode profiles need a project React
+development harness. Profiles describe the execution environment, not a proof
+that every possible interaction or lifecycle has been tested.
+
+Guarded mutations also run affected registered behavior checks, including contracts
+that depend on changed shared controllers. Failures reject the candidate before
+writing real source. Projects without contracts retain their existing checks.
+
 ## Guarded editing
 
 Enable editing in the MCP launch arguments and reconnect:
@@ -209,6 +241,22 @@ imports for canonical files created/deleted in that patch. Preserve other import
 and comments, retain the foundation entry, and follow the required import order.
 Both files pass the same candidate checks before either is written.
 
+Runtime owner manifests also list `ds.config.json` in `companionFiles`. An owner's
+patch may update only its own `inlineStyleFiles` and `boundaries.styleWrites`
+entries together with its source. All other settings and peer permissions must
+remain unchanged. This supports atomic JSX-to-imperative geometry migrations,
+new boundaries and removal of obsolete permissions without bypassing the gate.
+Unused inline exceptions and properties never written fail `stale-style-boundary`;
+configuration-first registration of an unused boundary therefore fails validation.
+General policy, component customization hooks and compiler changes still use the
+`configuration` unit.
+
+A directory owner's runtime entry (`index` or a source file matching its directory
+name) or colocated fixture keeps ownership stable without `Scenario.tsx`.
+A redundant standalone scenario can be removed when other registered scenarios
+still declare and actually render its public exports. Coverage requirements remain
+in force; there is no metadata waiver for uncovered UI.
+
 The same discovery covers the rest of the project ADS:
 
 | Unit | Scope |
@@ -262,6 +310,13 @@ not an edit to live ADS source. Binary `ads_read_file` results return the digest
 byte count without encoded content. Git verifies the original binary blob and
 reconstructs the result inside the validation copy.
 
+Resolve ownership diagnostics by preserving the required capability in its proper
+layer. Demo-only sizing, borders and framing belong in a public review/layout
+pattern; a component API addition needs a runtime use case. Measured imperative
+geometry uses exact `styleWrites` properties. After migrating JSX inline geometry,
+replace its own boundary entries in the same owner patch and check the final state.
+After the gates pass, verify the behavior in a browser.
+
 A small change needs only its hunk. A complete new component may include its
 implementation, public re-export, scenario and fixture in the same unit patch,
 so coverage is checked against a complete candidate. New units use a new
@@ -378,6 +433,13 @@ and unchanged styles/fonts are reused. External hosts may create a fresh App for
 each tool call. Each fresh App loads independently through the same contract.
 There is no special local direct-artifact rendering path.
 
+`ads_check` returns blocking `diagnostics` separately from bounded nonblocking
+`advisories`, with `advisoryCount`. The checks resource contains the full result.
+For example, `pointer-capture-review` reports capture without a locally visible
+capture-loss handler. Cleanup can be delegated; inspect it and test cancellation,
+capture loss and teardown. A local handler suppresses that advisory but does not
+prove correct behavior. Accepted mutations also return bounded advisories.
+
 ### Host boundary and compatibility
 
 The showcase's packaged shell retains its own minimal CSS and navigation. It
@@ -510,8 +572,15 @@ Managed configuration changes replace the compiler through the same supervisor.
 Updating ADS server code itself still requires reconnecting the MCP client to load
 the new package. Normal component, fixture and style edits remain automatic.
 
-ADS stops the managed watcher and its compiler subprocesses when stdin closes or
-it receives SIGINT/SIGTERM. The project must keep its watcher in the foreground,
+ADS closes both network hosts and stops the managed watcher and its compiler
+subprocesses when the stdio wire closes, including EOF or broken output, or it
+receives SIGINT/SIGTERM. Active browser subscriptions do not retain the runtime.
+A small independent ownership guard watches a pipe from MCP; owner death closes
+that pipe even after SIGKILL. The guard terminates the owned compiler process
+group, escalates for stubborn descendants, then exits. It is disarmed on ordinary
+shutdown; `previewWatch.guardPid` identifies it while running. This requires no
+second user command and applies to custom builders too.
+The project must keep its watcher in the foreground,
 rather than launching detached background processes. The configuration is
 trusted project setup; MCP tools accept no executable or command arguments.
 To manage builds yourself, omit `previewWatch` or set it to `null`, then run the
@@ -650,7 +719,7 @@ See the [MCP Apps specification](https://github.com/modelcontextprotocol/ext-app
 | Each of the five ADS skill names | `request` | Select that workflow and its skill resource |
 
 Example: get `ads-inspect` with `element="Button states in both themes"`, or
-`ads-assimilate` with `request` containing the upstream component-library URL.
+`ads-migrate` with `request` containing the upstream component-library URL.
 Prompts explain Data/UX/Skin ownership, public API reuse, fixture boundaries,
 which tools select widgets, progressive skill reads and validation. They guide
 reasoning rather than inventing another component implementation.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reqvire-org/ads",
-  "version": "0.3.2",
+  "version": "0.3.5",
   "type": "module",
   "description": "A design system your agent can see and shape. Your components. Your look. Your code.",
   "repository": {
@@ -69,6 +69,7 @@
     "@modelcontextprotocol/client": "2.3.1",
     "@modelcontextprotocol/ext-apps": "2.0.3",
     "@modelcontextprotocol/sdk": "1.32.1",
+    "@playwright/test": "1.64.1",
     "@preact/signals": "2.11.3",
     "@types/node": "^25.9.2",
     "@types/react": "^19.2.17",
@@ -98,7 +99,8 @@
     "./mcp/build": "./dist/mcp/build-status.mjs",
     "./scenarios": "./dist/scenarios.mjs",
     "./scenarios/vite": "./dist/scenarios-vite.mjs",
-    "./scenarios/compiler": "./dist/scenarios-compiler.mjs"
+    "./scenarios/compiler": "./dist/scenarios-compiler.mjs",
+    "./verification": "./dist/verification/browser.mjs"
   },
   "files": [
     "dist",

package/dist/skills/ads-assimilate/agents/openai.yaml

@@ -1,4 +0,0 @@
-interface:
-  display_name: "ADS Assimilate"
-  short_description: "Adapt reference components into a native design system"
-  default_prompt: "Use $ads-assimilate with a component-library URL to implement and verify a native design-system component."