@tendrilapp/cli 0.1.14 → 0.1.16

package/dist/tendril.js

@@ -996,7 +996,7 @@ function sessionStatus(setDir) {
   const manifest = loadManifest(setDir);
   const reps = manifest.reps.map((rep) => {
     const recorded = RECORD_TOOLS.filter((t) => existsSync(path.join(setDir, rep.slug, `${t}.json`)));
-    const missing = requiredToolsFor(manifest, rep.slug).filter((t) => !recorded.includes(t));
+    const missing = byProtocolOrder(requiredToolsFor(manifest, rep.slug).filter((t) => !recorded.includes(t)));
     return { slug: rep.slug, nodeId: rep.nodeId, recorded, missing };
   });
   return { reps, complete: reps.every((r) => r.missing.length === 0) };
@@ -1066,7 +1066,7 @@ function ingestAsset(setDir, slug, name, content) {
   mkdirSync(path.dirname(file), { recursive: true });
   writeFileSync(file, content);
 }
-var RECORD_TOOLS, INTERIOR_TOOL, REQUIRED_TOOLS, SessionManifestSchema, manifestPath;
+var RECORD_TOOLS, INTERIOR_TOOL, REQUIRED_TOOLS, SessionManifestSchema, manifestPath, PROTOCOL_ORDER, byProtocolOrder;
 var init_session = __esm({
   "packages/figma/src/recording/session.ts"() {
     "use strict";
@@ -1108,6 +1108,8 @@ var init_session = __esm({
       roles: z4.unknown().optional()
     });
     manifestPath = (setDir) => path.join(setDir, "recording-set.json");
+    PROTOCOL_ORDER = ["get_metadata", "get_design_context", "get_screenshot", "get_variable_defs", "get_metadata_interior"];
+    byProtocolOrder = (tools) => [...tools].sort((a, b) => PROTOCOL_ORDER.indexOf(a) - PROTOCOL_ORDER.indexOf(b));
   }
 });
 
@@ -1212,8 +1214,8 @@ var init_src = __esm({
 function variableNameToPath(name) {
   return name.split("/").map(canonicalCssIdentPart).filter((part) => part.length > 0);
 }
-function tokenPathToCssVar(path34) {
-  return `--${path34.join("-")}`;
+function tokenPathToCssVar(path35) {
+  return `--${path35.join("-")}`;
 }
 function toDtcgToken(variable, defaultMode) {
   const modes = Object.keys(variable.valuesByMode);
@@ -1257,11 +1259,11 @@ function toDtcgToken(variable, defaultMode) {
 }
 function mapVariablesToDtcg(variables, defaultMode = "light") {
   const entries = variables.map((variable) => {
-    const path34 = variableNameToPath(variable.name);
-    if (path34.length === 0) {
+    const path35 = variableNameToPath(variable.name);
+    if (path35.length === 0) {
       throw new DtcgMappingError("empty-name", `Figma variable ${variable.id} has an empty name`);
     }
-    return { variable, path: path34 };
+    return { variable, path: path35 };
   });
   const groupPrefixes = /* @__PURE__ */ new Set();
   for (const e of entries) {
@@ -1282,21 +1284,21 @@ function mapVariablesToDtcg(variables, defaultMode = "light") {
   }
   const tokens = {};
   const flat = [];
-  for (const { variable, path: path34 } of entries) {
+  for (const { variable, path: path35 } of entries) {
     const token = toDtcgToken(variable, defaultMode);
     let group = tokens;
-    for (const segment of path34.slice(0, -1)) {
+    for (const segment of path35.slice(0, -1)) {
       const existing = group[segment];
       group = existing ?? (group[segment] = {});
     }
-    const leaf = path34[path34.length - 1];
+    const leaf = path35[path35.length - 1];
     if (group[leaf] !== void 0) {
-      throw new DtcgMappingError("duplicate-path", `Duplicate token path "${path34.join(".")}" (variable ${variable.id})`);
+      throw new DtcgMappingError("duplicate-path", `Duplicate token path "${path35.join(".")}" (variable ${variable.id})`);
     }
     group[leaf] = token;
     flat.push({
-      path: path34.join("."),
-      cssVar: tokenPathToCssVar(path34),
+      path: path35.join("."),
+      cssVar: tokenPathToCssVar(path35),
       type: token.$type,
       value: token.$value
     });
@@ -1485,9 +1487,9 @@ function boundId(value) {
   return isObject(value) && typeof value["boundVariableId"] === "string" ? value["boundVariableId"] : void 0;
 }
 function resolveBinding(ctx, id) {
-  const path34 = ctx.pathById.get(id);
-  if (path34 === void 0) ctx.unresolved.add(id);
-  return path34;
+  const path35 = ctx.pathById.get(id);
+  if (path35 === void 0) ctx.unresolved.add(id);
+  return path35;
 }
 function parseVariantProps(name) {
   if (!name.includes("=")) return void 0;
@@ -1522,8 +1524,8 @@ function walk(ctx, raw) {
       if (!isObject(paint) || paint["visible"] === false) continue;
       const id = boundId(paint);
       if (id !== void 0) {
-        const path34 = resolveBinding(ctx, id);
-        if (path34 !== void 0) tokens.add(path34);
+        const path35 = resolveBinding(ctx, id);
+        if (path35 !== void 0) tokens.add(path35);
       } else if (typeof paint["color"] === "string") {
         ctx.hardcoded.push({ node: name, property, value: paint["color"] });
       }
@@ -1531,8 +1533,8 @@ function walk(ctx, raw) {
   }
   const radiusId = boundId(raw["cornerRadius"]);
   if (radiusId !== void 0) {
-    const path34 = resolveBinding(ctx, radiusId);
-    if (path34 !== void 0) tokens.add(path34);
+    const path35 = resolveBinding(ctx, radiusId);
+    if (path35 !== void 0) tokens.add(path35);
   } else if (typeof raw["cornerRadius"] === "number" && raw["cornerRadius"] !== 0) {
     ctx.hardcoded.push({ node: name, property: "border-radius", value: `${raw["cornerRadius"]}px` });
   }
@@ -1542,10 +1544,10 @@ function walk(ctx, raw) {
     layout = { mode: layoutMode === "HORIZONTAL" ? "flex-row" : "flex-column" };
     const gapId = boundId(raw["itemSpacing"]);
     if (gapId !== void 0) {
-      const path34 = resolveBinding(ctx, gapId);
-      if (path34 !== void 0) {
-        layout.gap = path34;
-        tokens.add(path34);
+      const path35 = resolveBinding(ctx, gapId);
+      if (path35 !== void 0) {
+        layout.gap = path35;
+        tokens.add(path35);
       }
     } else if (typeof raw["itemSpacing"] === "number" && raw["itemSpacing"] !== 0) {
       ctx.hardcoded.push({ node: name, property: "gap", value: `${raw["itemSpacing"]}px` });
@@ -1554,10 +1556,10 @@ function walk(ctx, raw) {
     for (const field of PADDING_FIELDS) {
       const id = boundId(raw[field]);
       if (id !== void 0) {
-        const path34 = resolveBinding(ctx, id);
-        if (path34 !== void 0) {
-          paddingPaths.push(path34);
-          tokens.add(path34);
+        const path35 = resolveBinding(ctx, id);
+        if (path35 !== void 0) {
+          paddingPaths.push(path35);
+          tokens.add(path35);
         }
       } else if (typeof raw[field] === "number" && raw[field] !== 0) {
         ctx.hardcoded.push({ node: name, property: field, value: `${raw[field]}px` });
@@ -1977,7 +1979,13 @@ async function runTokenLint(css, fileLabel = "generated.css", definedVars2) {
       file: fileLabel,
       line: w.line,
       property: w.rule,
-      message: w.text
+      // Run 7: a single-pose token map left 15 of 20 colors with no
+      // token to reference, and 22 strict-value findings read as
+      // must-fix while the brief forbade inventing names — unfixable
+      // noise in the highest-attention output. The finding stays (a
+      // matching token SHOULD be referenced when one exists); the
+      // message now carries the escape hatch.
+      message: w.rule === "scale-unlimited/declaration-strict-value" ? `${w.text} \u2014 ADVISORY: reference the design token if the kit provides one; if it does not, the literal is CORRECT \u2014 never invent a token name (the recorded token map captures one pose's variables and is known-partial)` : w.text
     }))
   );
   const ownDefs = /* @__PURE__ */ new Set();
@@ -2324,6 +2332,23 @@ function detectBackdrop(png, opts = {}) {
   const { modal, consensus } = ringConsensus(png);
   if (consensus < 0.9) return [255, 255, 255];
   if (Math.min(...modal) < 200 && opts.trustDark !== true) return [255, 255, 255];
+  const decoded = PNG.sync.read(Buffer.from(png));
+  if (decoded.width >= 4 && decoded.height >= 4) {
+    const blocks = cornerBlocks(decoded, 2);
+    const first = blocks[0];
+    const cornersAgree = blocks.every((c) => Math.abs(c[0] - first[0]) + Math.abs(c[1] - first[1]) + Math.abs(c[2] - first[2]) <= INK_DELTA);
+    const cornersDisagreeWithRing = Math.abs(first[0] - modal[0]) + Math.abs(first[1] - modal[1]) + Math.abs(first[2] - modal[2]) > INK_DELTA;
+    if (cornersAgree && cornersDisagreeWithRing) {
+      const extremes = cornerBlocks(decoded, 1);
+      const value = [
+        Math.round(extremes.reduce((a, c) => a + c[0], 0) / 4),
+        Math.round(extremes.reduce((a, c) => a + c[1], 0) / 4),
+        Math.round(extremes.reduce((a, c) => a + c[2], 0) / 4)
+      ];
+      if (Math.min(...value) < 200 && opts.trustDark !== true) return [255, 255, 255];
+      return value;
+    }
+  }
   return modal;
 }
 function pngDimensions(png) {
@@ -5118,6 +5143,107 @@ var init_output = __esm({
   }
 });
 
+// packages/cli/src/entitlement.ts
+import { chmodSync, existsSync as existsSync16, mkdirSync as mkdirSync4, readFileSync as readFileSync13, writeFileSync as writeFileSync7 } from "node:fs";
+import crypto from "node:crypto";
+import os3 from "node:os";
+import path21 from "node:path";
+function entitlementPath() {
+  return process.env["TENDRIL_ENTITLEMENT_PATH"] ?? path21.join(os3.homedir(), ".tendril", "entitlement.json");
+}
+function readStoredEntitlement(file = entitlementPath()) {
+  if (!existsSync16(file)) return void 0;
+  try {
+    const parsed = JSON.parse(readFileSync13(file, "utf8"));
+    if (typeof parsed.token !== "string" || typeof parsed.lastRefreshAt !== "number") return void 0;
+    return { token: parsed.token, lastRefreshAt: parsed.lastRefreshAt };
+  } catch {
+    return void 0;
+  }
+}
+function writeStoredEntitlement(stored, file = entitlementPath()) {
+  mkdirSync4(path21.dirname(file), { recursive: true });
+  writeFileSync7(file, `${JSON.stringify(stored, null, 2)}
+`);
+  chmodSync(file, 384);
+}
+function parseEntitlementToken(token) {
+  if (!token.startsWith(ENT_PREFIX)) return { error: "not a tendril entitlement token" };
+  const parts = token.slice(ENT_PREFIX.length).split(".");
+  if (parts.length !== 2 || parts[0] === "" || parts[1] === "") return { error: "malformed token (expected payload.signature)" };
+  let claims;
+  try {
+    claims = JSON.parse(b64urlDecode(parts[0]).toString("utf8"));
+  } catch {
+    return { error: "payload is not valid JSON" };
+  }
+  if (typeof claims.sub !== "string" || typeof claims.plan !== "string" || typeof claims.iat !== "number" || typeof claims.exp !== "number" || typeof claims.kid !== "string") {
+    return { error: "payload is missing required claims" };
+  }
+  return { claims, signedData: b64urlDecode(parts[0]), signature: b64urlDecode(parts[1]) };
+}
+function checkEntitlement(opts = {}) {
+  const keys = opts.keys ?? PUBLIC_KEYS;
+  if (Object.keys(keys).length === 0) return { ok: true, mode: "pre-launch" };
+  const now = opts.now ?? Date.now();
+  const stored = "stored" in opts ? opts.stored : readStoredEntitlement();
+  if (stored === void 0) {
+    return { ok: false, code: "entitlement-required", error: "no entitlement on this machine \u2014 record and generate need an active Tendril plan (verify stays free, always)", remediation: ACTIVATE_REMEDIATION };
+  }
+  const parsed = parseEntitlementToken(stored.token);
+  if ("error" in parsed) {
+    return { ok: false, code: "entitlement-invalid", error: `stored entitlement is unreadable: ${parsed.error}`, remediation: ACTIVATE_REMEDIATION };
+  }
+  const pem = keys[parsed.claims.kid];
+  const valid = pem !== void 0 && (() => {
+    try {
+      return crypto.verify(null, parsed.signedData, crypto.createPublicKey(pem), parsed.signature);
+    } catch {
+      return false;
+    }
+  })();
+  if (!valid) {
+    return { ok: false, code: "entitlement-invalid", error: "stored entitlement failed signature verification", remediation: ACTIVATE_REMEDIATION };
+  }
+  if (now > parsed.claims.exp + TOLERANCE_MS) {
+    return {
+      ok: false,
+      code: "entitlement-expired",
+      error: "entitlement expired (and the offline tolerance window has passed)",
+      remediation: `Reconnect and ${ACTIVATE_REMEDIATION}`
+    };
+  }
+  if (now < stored.lastRefreshAt - CLOCK_ROLLBACK_MS) {
+    return {
+      ok: false,
+      code: "entitlement-clock",
+      error: "system clock sits more than a day before the last entitlement refresh",
+      remediation: `Fix the system clock, then ${ACTIVATE_REMEDIATION}`
+    };
+  }
+  return { ok: true, mode: "active", claims: parsed.claims, stale: now > parsed.claims.exp };
+}
+function requireEntitlement(flags) {
+  const status = checkEntitlement();
+  if (!status.ok) {
+    fail(flags, ExitCode.Auth, { error: status.error, code: status.code, remediation: status.remediation });
+  }
+}
+var ENT_PREFIX, PUBLIC_KEYS, TOLERANCE_MS, CLOCK_ROLLBACK_MS, b64urlDecode, ACTIVATE_REMEDIATION;
+var init_entitlement = __esm({
+  "packages/cli/src/entitlement.ts"() {
+    "use strict";
+    init_src3();
+    init_output();
+    ENT_PREFIX = "tendril-ent.v1.";
+    PUBLIC_KEYS = {};
+    TOLERANCE_MS = 24 * 60 * 60 * 1e3;
+    CLOCK_ROLLBACK_MS = 24 * 60 * 60 * 1e3;
+    b64urlDecode = (s) => Buffer.from(s, "base64url");
+    ACTIVATE_REMEDIATION = "Run `tendril activate` in your terminal (a browser approval \u2014 never paste license material into an agent chat).";
+  }
+});
+
 // packages/llm/src/model-config.ts
 import { z as z6 } from "zod";
 function resolveModel(config, requestedId) {
@@ -6309,6 +6435,100 @@ var init_src6 = __esm({
   }
 });
 
+// packages/cli/src/commands/activate.ts
+var activate_exports = {};
+__export(activate_exports, {
+  ENTITLEMENT_SERVICE_URL: () => ENTITLEMENT_SERVICE_URL,
+  runActivate: () => runActivate
+});
+async function runActivate(flags) {
+  const base = flags.serviceUrl ?? ENTITLEMENT_SERVICE_URL;
+  if (base === void 0) {
+    fail(flags, ExitCode.Auth, {
+      error: "the Tendril entitlement service is not live yet (pre-launch build) \u2014 there is nothing to activate against",
+      code: "entitlement-service-unavailable",
+      remediation: "Nothing to do: pre-launch builds run record/generate without activation. This command becomes meaningful at launch."
+    });
+  }
+  let device;
+  try {
+    const res = await fetch(new URL("/v1/device/code", base), { method: "POST", headers: { "content-type": "application/json" }, body: "{}" });
+    if (!res.ok) throw new Error(`HTTP ${res.status}`);
+    device = await res.json();
+    if (typeof device.deviceCode !== "string" || typeof device.userCode !== "string" || typeof device.verificationUri !== "string") throw new Error("malformed device-code response");
+  } catch (err) {
+    fail(flags, ExitCode.Auth, {
+      error: `could not start activation: ${err instanceof Error ? err.message : String(err)}`,
+      code: "entitlement-service-unreachable",
+      remediation: "Check your connection and retry `tendril activate`."
+    });
+  }
+  process.stderr.write(`To activate Tendril, visit:
+
+    ${device.verificationUri}
+
+and enter the code: ${device.userCode}
+
+Waiting for approval\u2026
+`);
+  const interval = Math.max(1e3, device.intervalMs ?? 5e3);
+  const deadline = Date.now() + (device.expiresInMs ?? 10 * 60 * 1e3);
+  let token;
+  while (Date.now() < deadline) {
+    await new Promise((r) => setTimeout(r, interval));
+    const res = await fetch(new URL("/v1/device/token", base), {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ deviceCode: device.deviceCode })
+    }).catch(() => void 0);
+    if (res === void 0) continue;
+    if (res.status === 428) continue;
+    if (!res.ok) {
+      fail(flags, ExitCode.Auth, {
+        error: `activation was not approved (HTTP ${res.status})`,
+        code: "entitlement-denied",
+        remediation: "Retry `tendril activate`; if it persists, check the account's plan in the portal."
+      });
+    }
+    token = (await res.json()).token;
+    break;
+  }
+  if (token === void 0) {
+    fail(flags, ExitCode.Auth, {
+      error: "activation timed out before the browser approval arrived",
+      code: "entitlement-timeout",
+      remediation: "Run `tendril activate` again and complete the browser step within the shown window."
+    });
+  }
+  const parsed = parseEntitlementToken(token);
+  if ("error" in parsed) {
+    fail(flags, ExitCode.Auth, {
+      error: `service returned an unusable token: ${parsed.error}`,
+      code: "entitlement-invalid",
+      remediation: "Retry `tendril activate`; report this if it persists \u2014 it is a service-side fault."
+    });
+  }
+  if (Object.keys(PUBLIC_KEYS).length > 0) {
+    const status = checkEntitlement({ now: Date.now(), stored: { token, lastRefreshAt: Date.now() } });
+    if (!status.ok) fail(flags, ExitCode.Auth, { error: `service returned a token this build cannot verify: ${status.error}`, code: status.code, remediation: status.remediation });
+  }
+  writeStoredEntitlement({ token, lastRefreshAt: Date.now() });
+  emitData(flags, { activated: true, plan: parsed.claims.plan, sub: parsed.claims.sub, expiresAt: new Date(parsed.claims.exp).toISOString(), storedAt: entitlementPath() }, () => {
+    process.stdout.write(`activated: plan "${parsed.claims.plan}" until ${new Date(parsed.claims.exp).toISOString().slice(0, 10)} (stored at ${entitlementPath()})
+`);
+  });
+}
+var ENTITLEMENT_SERVICE_URL;
+var init_activate = __esm({
+  "packages/cli/src/commands/activate.ts"() {
+    "use strict";
+    init_src3();
+    init_entitlement();
+    init_output();
+    ENTITLEMENT_SERVICE_URL = void 0;
+  }
+});
+
 // packages/cli/src/commands/record.ts
 var record_exports = {};
 __export(record_exports, {
@@ -6325,11 +6545,11 @@ __export(record_exports, {
   runRecordPlan: () => runRecordPlan,
   runRecordStatus: () => runRecordStatus
 });
-import { existsSync as existsSync18, readFileSync as readFileSync15, readdirSync as readdirSync4 } from "node:fs";
-import path24 from "node:path";
-import { writeFileSync as writeFileSync8 } from "node:fs";
+import { existsSync as existsSync19, readFileSync as readFileSync16, readdirSync as readdirSync5 } from "node:fs";
+import path25 from "node:path";
+import { writeFileSync as writeFileSync9 } from "node:fs";
 function symbolsFromMetadataEnvelope(file, sourceFrame) {
-  const env = JSON.parse(readFileSync15(file, "utf8"));
+  const env = JSON.parse(readFileSync16(file, "utf8"));
   const text = env.content.map((c) => c.text ?? "").join("\n");
   const symbols = [];
   const walk2 = (node, ancestor) => {
@@ -6359,6 +6579,7 @@ function instanceLeads(text) {
   return [...seen.entries()].map(([name, nodeId]) => ({ name, nodeId }));
 }
 function runRecordPlan(opts) {
+  requireEntitlement(opts);
   const defaults = {};
   for (const spec of opts.defaultSpecs ?? []) {
     const eq = spec.indexOf("=");
@@ -6376,7 +6597,7 @@ function runRecordPlan(opts) {
   for (const spec of opts.metadataFiles) {
     const [file, frame] = spec.split("@");
     try {
-      const parsed = symbolsFromMetadataEnvelope(path24.resolve(file), frame);
+      const parsed = symbolsFromMetadataEnvelope(path25.resolve(file), frame);
       symbols.push(...parsed.symbols);
       if (parsed.truncated) metadataTruncated = true;
     } catch (err) {
@@ -6410,7 +6631,7 @@ function runRecordPlan(opts) {
     const leads = opts.metadataFiles.flatMap((spec) => {
       const [file] = spec.split("@");
       try {
-        const env = JSON.parse(readFileSync15(path24.resolve(file), "utf8"));
+        const env = JSON.parse(readFileSync16(path25.resolve(file), "utf8"));
         return instanceLeads(env.content.map((c) => c.text ?? "").join("\n"));
       } catch {
         return [];
@@ -6467,6 +6688,10 @@ function runRecordPlan(opts) {
       ...toppedUp !== void 0 ? { toppedUp } : {},
       notRecorded: manifest.notRecorded ?? null,
       figmaCallEstimate: { reps: manifest.reps.length, calls: `~${callLow}\u2013${callHigh}` },
+      // Cold-start fix (run 7): the first instruction rides the plan
+      // response, so record_next is never needed to begin — it exists
+      // only for resuming.
+      next: nextPayload(opts.setDir),
       ...toConfirm.length > 0 ? {
         defaultsToConfirm: {
           instruction: "HEURISTIC defaults: the designer named no literal Default and no override was given, so the code guessed the component's zero point \u2014 the pose an empty-props mount shows and the pose behaviour checks aim at. When a USER is present, ask each question below BEFORE recording; if they pick a different value, re-run this exact plan command with --default <Axis>=<Value> (allowed until the first envelope is ingested; frozen with the recording after). Non-interactive: proceed with the resolved values and state them in your report.",
@@ -6511,7 +6736,7 @@ function nextPayload(setDir) {
   const instruction = nextInstruction(setDir);
   const status = sessionStatus(setDir);
   const progress = { recordedReps: status.reps.filter((x) => x.missing.length === 0).length, totalReps: status.reps.length };
-  if (instruction === null && !existsSync18(path24.join(setDir, "get_variable_defs.json"))) {
+  if (instruction === null && !existsSync19(path25.join(setDir, "get_variable_defs.json"))) {
     const manifest = loadManifest(setDir);
     const frameNode = Object.keys(manifest.sourceFrames ?? {})[0] ?? manifest.reps[0]?.nodeId ?? "";
     return { slug: "__set__", nodeId: frameNode, tool: "get_variable_defs", note: `SET-LEVEL: call get_variable_defs on the component frame and ingest with --rep __set__. ${ENVELOPE_HELP}`, progress };
@@ -6602,7 +6827,7 @@ async function autoFetchAssets(setDir, rep, envelopeText2) {
   const skipped = [];
   const failed = [];
   for (const { url, name } of assetUrlsFromEnvelopeText(envelopeText2)) {
-    if (existsSync18(path24.join(setDir, rep, name))) {
+    if (existsSync19(path25.join(setDir, rep, name))) {
       skipped.push(name);
       continue;
     }
@@ -6624,16 +6849,16 @@ async function autoFetchAssets(setDir, rep, envelopeText2) {
 }
 function rawEnvelopeFromFile(file, parts) {
   if (parts) {
-    const blocks = JSON.parse(readFileSync15(path24.resolve(file), "utf8"));
+    const blocks = JSON.parse(readFileSync16(path25.resolve(file), "utf8"));
     if (!Array.isArray(blocks) || blocks.length === 0 || blocks.some((p) => typeof p !== "string")) throw new Error("parts file must be a non-empty JSON array of strings");
     return { content: blocks.map((text) => ({ type: "text", text })) };
   }
-  return { content: [{ type: "text", text: readFileSync15(path24.resolve(file), "utf8") }] };
+  return { content: [{ type: "text", text: readFileSync16(path25.resolve(file), "utf8") }] };
 }
 async function runRecordIngest(opts) {
   let payload;
   try {
-    payload = opts.rawParts === true || opts.raw === true ? rawEnvelopeFromFile(opts.file, opts.rawParts === true) : JSON.parse(readFileSync15(path24.resolve(opts.file), "utf8"));
+    payload = opts.rawParts === true || opts.raw === true ? rawEnvelopeFromFile(opts.file, opts.rawParts === true) : JSON.parse(readFileSync16(path25.resolve(opts.file), "utf8"));
   } catch (err) {
     fail(opts, ExitCode.InputValidation, {
       error: `cannot read envelope file: ${err instanceof Error ? err.message : String(err)}`,
@@ -6657,7 +6882,7 @@ async function runRecordIngest(opts) {
         remediation: "Save the get_variable_defs response verbatim as a text envelope."
       });
     }
-    writeFileSync8(path24.join(opts.setDir, "get_variable_defs.json"), `${JSON.stringify(payload, null, 1)}
+    writeFileSync9(path25.join(opts.setDir, "get_variable_defs.json"), `${JSON.stringify(payload, null, 1)}
 `);
     emitData(opts, { ingested: "get_variable_defs", rep: "__set__", setLevel: true, next: nextPayload(opts.setDir) }, () => {
       process.stdout.write("set-level get_variable_defs ingested\n");
@@ -6753,8 +6978,8 @@ async function runRecordIngestRep(opts) {
 }
 function runRecordAsset(opts) {
   if (opts.dir !== void 0) {
-    const dir = path24.resolve(opts.dir);
-    const names = readdirSync4(dir).filter((f) => /^asset-[\w.-]+\.(svg|png|jpe?g|webp|gif)$/i.test(f));
+    const dir = path25.resolve(opts.dir);
+    const names = readdirSync5(dir).filter((f) => /^asset-[\w.-]+\.(svg|png|jpe?g|webp|gif)$/i.test(f));
     if (names.length === 0) {
       fail(opts, ExitCode.InputValidation, {
         error: `no asset-*.<ext> files found in ${dir}`,
@@ -6765,7 +6990,7 @@ function runRecordAsset(opts) {
     const ingested = [];
     try {
       for (const name of names) {
-        ingestAsset(opts.setDir, opts.rep, name, readFileSync15(path24.join(dir, name)));
+        ingestAsset(opts.setDir, opts.rep, name, readFileSync16(path25.join(dir, name)));
         ingested.push(name);
       }
     } catch (err) {
@@ -6789,7 +7014,7 @@ function runRecordAsset(opts) {
     });
   }
   try {
-    ingestAsset(opts.setDir, opts.rep, opts.name, readFileSync15(path24.resolve(opts.file)));
+    ingestAsset(opts.setDir, opts.rep, opts.name, readFileSync16(path25.resolve(opts.file)));
     emitData(opts, { rep: opts.rep, asset: opts.name }, () => {
       process.stdout.write(`ingested ${opts.rep}/${opts.name}
 `);
@@ -6817,7 +7042,7 @@ ${status.reps.filter((r) => r.missing.length > 0).length} rep(s) pending
 function runRecordFinish(opts) {
   const manifest = loadManifest(opts.setDir);
   const derived = deriveRoles(opts.setDir, manifest);
-  const roles = opts.rolesFile !== void 0 ? { ...JSON.parse(readFileSync15(path24.resolve(opts.rolesFile), "utf8")), humanOverride: true } : { main: derived.main, parts: derived.parts, external: derived.external, humanOverride: false };
+  const roles = opts.rolesFile !== void 0 ? { ...JSON.parse(readFileSync16(path25.resolve(opts.rolesFile), "utf8")), humanOverride: true } : { main: derived.main, parts: derived.parts, external: derived.external, humanOverride: false };
   emitData(opts, { derived, confirmed: opts.confirmRoles }, () => {
     process.stdout.write(`derived mains: ${derived.main.join(", ") || "(none)"}
 `);
@@ -6844,7 +7069,7 @@ function runRecordFinish(opts) {
     });
   }
   const updated = { ...manifest, roles };
-  writeFileSync8(path24.join(opts.setDir, "recording-set.json"), `${JSON.stringify(updated, null, 1)}
+  writeFileSync9(path25.join(opts.setDir, "recording-set.json"), `${JSON.stringify(updated, null, 1)}
 `);
   if (!opts.json) process.stdout.write("roles written to recording-set.json\n");
 }
@@ -6855,6 +7080,7 @@ var init_record = __esm({
     init_src3();
     init_src();
     init_output();
+    init_entitlement();
     ENVELOPE_HELP = 'Envelope format: text tools save {"content":[{"type":"text","text":"<VERBATIM response text incl. any Currently-selected-nodes block>"}]}; get_screenshot: do NOT download the image yourself \u2014 pass its image_url to `tendril record fetch` (MCP: tendril_record_fetch), which pulls the bytes to disk directly. That keeps the pixel ground truth out of your context and costs one approval instead of a shell command per asset. Assets are asset-<first-8-hex-of-figma-uuid>.<ext>; their URLs appear as const declarations inside the design-context text and also expire.';
     isAutoFetchAssetUrl = (url) => isFigmaAssetUrl(url) || isLocalAssetUrl(url);
   }
@@ -7047,8 +7273,8 @@ var init_engine_curated = __esm({
 });
 
 // packages/generate/src/loop.ts
-import { existsSync as existsSync19, mkdirSync as mkdirSync5, readFileSync as readFileSync16, renameSync, writeFileSync as writeFileSync9 } from "node:fs";
-import path25 from "node:path";
+import { existsSync as existsSync20, mkdirSync as mkdirSync6, readFileSync as readFileSync17, renameSync, writeFileSync as writeFileSync10 } from "node:fs";
+import path26 from "node:path";
 import { z as z11 } from "zod";
 function objective(scores, behaviors) {
   const vals = scores.map((s) => Math.min(s.similarity, s.inkRecall));
@@ -7079,9 +7305,9 @@ ${preludeLines.join("\n")}` : ""}
 Fix the FAIL configs (region coordinates are in the recorded screenshot's frame; ink<1 means recorded foreground pixels your render does not cover). Do not regress PASS configs. ${mode === "files" ? "Update the files in your candidate directory and re-run the score." : "Reply with the complete corrected files in the same FILE format."}`;
 }
 function archivePriorRun(outDir) {
-  if (!existsSync19(path25.join(outDir, "run-log.json")) && !existsSync19(path25.join(outDir, "loop-state.json"))) return void 0;
+  if (!existsSync20(path26.join(outDir, "run-log.json")) && !existsSync20(path26.join(outDir, "loop-state.json"))) return void 0;
   let n = 1;
-  while (existsSync19(`${outDir}-prev-${n}`)) n += 1;
+  while (existsSync20(`${outDir}-prev-${n}`)) n += 1;
   renameSync(outDir, `${outDir}-prev-${n}`);
   return `${outDir}-prev-${n}`;
 }
@@ -7090,14 +7316,14 @@ async function runEngineLoop(opts) {
   const plateau = opts.plateau ?? 2;
   const progress = opts.onProgress ?? (() => {
   });
-  const statePath = path25.join(opts.outDir, "loop-state.json");
-  const resuming = opts.resume === true && existsSync19(statePath);
+  const statePath = path26.join(opts.outDir, "loop-state.json");
+  const resuming = opts.resume === true && existsSync20(statePath);
   if (!resuming) {
     const archived = archivePriorRun(opts.outDir);
     if (archived !== void 0) progress(`previous run archived to ${archived}`);
   }
-  mkdirSync5(opts.outDir, { recursive: true });
-  const scratch = path25.join(opts.outDir, ".candidate");
+  mkdirSync6(opts.outDir, { recursive: true });
+  const scratch = path26.join(opts.outDir, ".candidate");
   let attempts = [];
   let log = [];
   let best;
@@ -7105,7 +7331,7 @@ async function runEngineLoop(opts) {
   let nonAccepted = 0;
   let stopReason = "max-iterations";
   if (resuming) {
-    const restored = LoopStateSchema.parse(JSON.parse(readFileSync16(statePath, "utf8")));
+    const restored = LoopStateSchema.parse(JSON.parse(readFileSync17(statePath, "utf8")));
     attempts = restored.attempts;
     log = restored.iterations;
     spentUsd = restored.spentUsd;
@@ -7120,12 +7346,12 @@ async function runEngineLoop(opts) {
     progress(`resumed: ${log.length} iteration(s), $${spentUsd.toFixed(3)} spent, best pass=${best?.objective[0] ?? 0}`);
   }
   const persist = () => {
-    writeFileSync9(statePath, `${JSON.stringify({ version: 1, spentUsd, attempts, iterations: log }, null, 1)}
+    writeFileSync10(statePath, `${JSON.stringify({ version: 1, spentUsd, attempts, iterations: log }, null, 1)}
 `);
   };
   const writeCandidate = (files) => {
-    mkdirSync5(scratch, { recursive: true });
-    for (const [name, content] of Object.entries(files)) writeFileSync9(path25.join(scratch, name), content);
+    mkdirSync6(scratch, { recursive: true });
+    for (const [name, content] of Object.entries(files)) writeFileSync10(path26.join(scratch, name), content);
   };
   const scoreCandidate = async (candidate, iter, usd, modelMs) => {
     writeCandidate(candidate.files);
@@ -7183,8 +7409,8 @@ async function runEngineLoop(opts) {
       const usd = candidate.usage?.usd ?? 0;
       spentUsd += usd;
       if (candidate.raw !== void 0) {
-        mkdirSync5(path25.join(opts.outDir, "responses"), { recursive: true });
-        writeFileSync9(path25.join(opts.outDir, "responses", `iter-${iter}.md`), candidate.raw);
+        mkdirSync6(path26.join(opts.outDir, "responses"), { recursive: true });
+        writeFileSync10(path26.join(opts.outDir, "responses", `iter-${iter}.md`), candidate.raw);
       }
       if (candidate.files[opts.entry] === void 0 || candidate.files["styles.css"] === void 0) {
         const finish = candidate.usage?.finishReason ?? "?";
@@ -7210,10 +7436,10 @@ async function runEngineLoop(opts) {
       }
     }
   }
-  if (best !== void 0) for (const [name, content] of Object.entries(best.files)) writeFileSync9(path25.join(opts.outDir, name), content);
+  if (best !== void 0) for (const [name, content] of Object.entries(best.files)) writeFileSync10(path26.join(opts.outDir, name), content);
   const final = best !== void 0 ? await opts.score(opts.outDir) : { scores: [], behaviors: [] };
-  writeFileSync9(
-    path25.join(opts.outDir, "run-log.json"),
+  writeFileSync10(
+    path26.join(opts.outDir, "run-log.json"),
     `${JSON.stringify(
       {
         ...opts.meta,
@@ -7280,8 +7506,8 @@ var init_loop2 = __esm({
 });
 
 // packages/generate/src/brief.ts
-import { existsSync as existsSync20, readFileSync as readFileSync17 } from "node:fs";
-import path26 from "node:path";
+import { existsSync as existsSync21, readFileSync as readFileSync18 } from "node:fs";
+import path27 from "node:path";
 function singleAxes2(name) {
   const parsed = parseVariantAxes(name);
   if (parsed === void 0) return void 0;
@@ -7407,8 +7633,8 @@ function authorComponentApi(opts) {
     configs.push({ rep: p.slug, component: componentIdent, props: {} });
   }
   if (inexpressible.length > 0) throw new PoseCompletenessError(inexpressible);
-  if (opts.dismissible === true) {
-    props.push({ name: "onDismiss", kind: "callback" });
+  if (opts.dismissible !== void 0) {
+    props.push({ name: "onDismiss", kind: "callback", default: opts.dismissible });
   }
   const entry = `${componentIdent}.tsx`;
   const apiPin = {
@@ -7417,13 +7643,15 @@ function authorComponentApi(opts) {
       name: pr.name,
       type: pr.kind === "boolean" ? "boolean" : pr.kind === "string" ? "string" : pr.kind === "callback" ? "() => void" : pr.values.map((v) => `"${v}"`).join(" | "),
       required: false,
-      ...pr.default !== void 0 ? { default: pr.default } : {}
+      // A callback's `default` field carries detection EVIDENCE for the
+      // prop line, not a value — it never enters the pin.
+      ...pr.default !== void 0 && pr.kind !== "callback" ? { default: pr.default } : {}
     })),
     forcedStates,
     poseCompleteness: { recordedPoses: opts.poses.length, expressible: configs.length }
   };
   const propLines = props.map(
-    (pr) => pr.kind === "boolean" ? `  ${pr.name}?: boolean;` : pr.kind === "string" ? `  ${pr.name}?: string; // CONTENT \u2014 recorded default ${JSON.stringify(pr.default)}` : pr.kind === "callback" ? `  ${pr.name}?: () => void; // NOTIFICATION \u2014 fires on the recorded affordance; the component owns its state (it hides/updates itself) and the callback informs, never controls` : `  ${pr.name}?: ${pr.values.map((v) => `"${v}"`).join(" | ")}; // default "${pr.default}"`
+    (pr) => pr.kind === "boolean" ? `  ${pr.name}?: boolean;` : pr.kind === "string" ? `  ${pr.name}?: string; // CONTENT \u2014 recorded default ${JSON.stringify(pr.default)}` : pr.kind === "callback" ? `  ${pr.name}?: () => void; // NOTIFICATION \u2014 recorded evidence: ${pr.default ?? "the recorded affordance"}; the component owns its state (it hides/updates itself) and the callback informs, never controls` : `  ${pr.name}?: ${pr.values.map((v) => `"${v}"`).join(" | ")}; // default "${pr.default}"`
   );
   const provided = opts.fonts ?? [];
   const recorded = opts.recordedFonts ?? [];
@@ -7496,7 +7724,7 @@ function authorBehaviors(api, extras = {}) {
     behaviors.push({
       id: `content-prop-renders(${sentinel.prop})`,
       config: sentinel.config,
-      props: { [sentinel.prop]: marker },
+      props: { ...sentinel.props ?? {}, [sentinel.prop]: marker },
       steps: [{ assertTextVisible: marker }]
     });
   }
@@ -7514,15 +7742,18 @@ function authorBehaviors(api, extras = {}) {
   return { behaviors, prelude: { controls: interactive ? ["> *"] : [], textInputs: [] }, disclosures };
 }
 function envelopeText(file) {
-  return envelopeFirstTextPart(JSON.parse(readFileSync17(file, "utf8")));
+  return envelopeFirstTextPart(JSON.parse(readFileSync18(file, "utf8")));
 }
 function dismissEvidence(setDir, repSlugs) {
   for (const slug of repSlugs) {
-    const f = path26.join(setDir, slug, "get_design_context.json");
-    if (!existsSync20(f)) continue;
-    for (const m of envelopeText(f).matchAll(/data-name="([^"]+)"/g)) {
+    const f = path27.join(setDir, slug, "get_design_context.json");
+    if (!existsSync21(f)) continue;
+    const text = envelopeText(f);
+    const propHit = /[{,]\s*(\w*dismiss\w*)\s*=\s*(?:true|false)\b/i.exec(text) ?? /\b(\w*dismiss\w*)\??\s*:\s*boolean\b/i.exec(text);
+    if (propHit !== null) return `emission prop "${propHit[1]}"`;
+    for (const m of text.matchAll(/data-name="([^"]+)"/g)) {
       const norm = m[1].toLowerCase().replace(/[^a-z0-9]/g, "");
-      if (DISMISS_NAMES.has(norm)) return m[1];
+      if (DISMISS_NAMES.has(norm)) return `layer ${JSON.stringify(m[1])}`;
     }
   }
   return void 0;
@@ -7560,13 +7791,13 @@ function recordedFontNeeds(setDir) {
     }
   };
   const manifest = loadManifest(setDir);
-  const setDefs = path26.join(setDir, "get_variable_defs.json");
-  if (existsSync20(setDefs)) fromDefs(envelopeText(setDefs));
+  const setDefs = path27.join(setDir, "get_variable_defs.json");
+  if (existsSync21(setDefs)) fromDefs(envelopeText(setDefs));
   for (const rep of manifest.reps) {
-    const ctx = path26.join(setDir, rep.slug, "get_design_context.json");
-    if (existsSync20(ctx)) fromEmission(envelopeText(ctx));
-    const defs = path26.join(setDir, rep.slug, "get_variable_defs.json");
-    if (existsSync20(defs)) fromDefs(envelopeText(defs));
+    const ctx = path27.join(setDir, rep.slug, "get_design_context.json");
+    if (existsSync21(ctx)) fromEmission(envelopeText(ctx));
+    const defs = path27.join(setDir, rep.slug, "get_variable_defs.json");
+    if (existsSync21(defs)) fromDefs(envelopeText(defs));
   }
   return [...byFamily.entries()].map(([family, paired]) => {
     const weights = /* @__PURE__ */ new Set([...paired, ...unpaired]);
@@ -7589,8 +7820,8 @@ function recordedTextSlots(setDir, repSlugs) {
   const propRep = [];
   const perRep = [];
   for (const slug of repSlugs) {
-    const f = path26.join(setDir, slug, "get_design_context.json");
-    if (!existsSync20(f)) continue;
+    const f = path27.join(setDir, slug, "get_design_context.json");
+    if (!existsSync21(f)) continue;
     const code = envelopeText(f);
     const props = /* @__PURE__ */ new Map();
     for (const m of code.matchAll(/[{,]\s*(\w+)\s*=\s*"((?:[^"\\]|\\.)*)"/g)) {
@@ -7606,12 +7837,17 @@ function recordedTextSlots(setDir, repSlugs) {
       if (t === "" || !/[A-Za-z0-9]/.test(t)) continue;
       texts.push(t);
     }
-    perRep.push({ slug, texts });
+    for (const m of code.matchAll(/>\{[`'"]([^`'"]+)[`'"]\}</g)) {
+      const t = decodeXmlEntities(m[1]).trim();
+      if (t === "" || !/[A-Za-z0-9]/.test(t)) continue;
+      texts.push(t);
+    }
+    perRep.push({ slug, texts, code });
   }
   const axisValuesBySlug = /* @__PURE__ */ new Map();
   for (const slug of repSlugs) {
-    const metaFile = path26.join(setDir, slug, "get_metadata.json");
-    if (!existsSync20(metaFile)) continue;
+    const metaFile = path27.join(setDir, slug, "get_metadata.json");
+    if (!existsSync21(metaFile)) continue;
     const name = symbolName(envelopeText(metaFile));
     if (name === void 0) continue;
     const values = /* @__PURE__ */ new Set();
@@ -7647,9 +7883,11 @@ function recordedTextSlots(setDir, repSlugs) {
       }
       const visibleIn = perRep.filter((r) => {
         const v = propRep.find((pr) => pr.slug === r.slug)?.props.get(name) ?? def;
-        return r.texts.some((t) => t.includes(v));
+        return r.texts.some((t) => t.includes(v)) || r.texts.join(" ").replace(/\s+/g, " ").includes(v.replace(/\s+/g, " ").trim());
       }).map((r) => r.slug);
-      return { prop: name, default: def, overrides, varies: Object.keys(overrides).length > 0, visibleIn };
+      const refPattern = new RegExp(`\\{\\s*${name}\\s*\\}`);
+      const referencedIn = perRep.filter((r) => refPattern.test(r.code)).map((r) => r.slug);
+      return { prop: name, default: def, overrides, varies: Object.keys(overrides).length > 0, visibleIn, referencedIn };
     });
   }
   if (perRep.length === 0) return [];
@@ -7696,7 +7934,7 @@ function recordedTextSlots(setDir, repSlugs) {
     usedNames.add(prop);
     const overrides = {};
     for (const [slug, v] of sl.values) if (v !== def) overrides[slug] = v;
-    return { prop, default: def, overrides, varies: Object.keys(overrides).length > 0, visibleIn: [...sl.values.keys()] };
+    return { prop, default: def, overrides, varies: Object.keys(overrides).length > 0, visibleIn: [...sl.values.keys()], referencedIn: [] };
   });
 }
 function authorTaskFromSet(setDir, opts = {}) {
@@ -7708,8 +7946,8 @@ function authorTaskFromSet(setDir, opts = {}) {
   const poses = [];
   const missing = [];
   for (const rep of manifest.reps) {
-    const metaFile = path26.join(setDir, rep.slug, "get_metadata.json");
-    if (!existsSync20(metaFile)) {
+    const metaFile = path27.join(setDir, rep.slug, "get_metadata.json");
+    if (!existsSync21(metaFile)) {
       missing.push(rep.slug);
       continue;
     }
@@ -7723,8 +7961,8 @@ function authorTaskFromSet(setDir, opts = {}) {
   if (missing.length > 0) {
     throw new Error(`recording set ${setDir} is missing metadata for ${missing.length} rep(s): ${missing.slice(0, 5).join(", ")}${missing.length > 5 ? ", \u2026" : ""}`);
   }
-  const setMeta = path26.join(setDir, "get_metadata.json");
-  const latticeNames = manifest.latticeNames ?? (existsSync20(setMeta) ? [...envelopeText(setMeta).matchAll(/name="([^"]*)"/g)].map((m) => decodeXmlEntities(m[1])) : void 0);
+  const setMeta = path27.join(setDir, "get_metadata.json");
+  const latticeNames = manifest.latticeNames ?? (existsSync21(setMeta) ? [...envelopeText(setMeta).matchAll(/name="([^"]*)"/g)].map((m) => decodeXmlEntities(m[1])) : void 0);
   const defaults = { ...manifest.defaults ?? {}, ...opts.defaults ?? {} };
   const recordedFonts = recordedFontFamilies(setDir);
   const textSlots = recordedTextSlots(setDir, manifest.reps.map((r) => r.slug));
@@ -7737,26 +7975,48 @@ function authorTaskFromSet(setDir, opts = {}) {
     ...recordedFonts.length > 0 ? { recordedFonts } : {},
     ...Object.keys(defaults).length > 0 ? { defaults } : {},
     ...textSlots.length > 0 ? { textSlots } : {},
-    ...dismissName !== void 0 ? { dismissible: true } : {}
+    ...dismissName !== void 0 ? { dismissible: dismissName } : {}
   });
   const anchorSlug = api.configs.find((c) => Object.keys(c.props).length === 0)?.rep ?? api.configs[0]?.rep;
-  const sentinels = textSlots.filter((slot) => !slot.varies && slot.visibleIn.length > 0).map((slot) => {
+  const sentinels = textSlots.filter((slot) => !slot.varies).map((slot) => {
     const authored = api.props.find((pr) => pr.kind === "string" && pr.default === slot.default);
-    return authored === void 0 ? void 0 : { prop: authored.name, config: anchorSlug !== void 0 && slot.visibleIn.includes(anchorSlug) ? anchorSlug : slot.visibleIn[0] };
+    if (authored === void 0) return void 0;
+    if (slot.visibleIn.length > 0) {
+      const entry = {
+        prop: authored.name,
+        config: anchorSlug !== void 0 && slot.visibleIn.includes(anchorSlug) ? anchorSlug : slot.visibleIn[0]
+      };
+      return entry;
+    }
+    if (slot.referencedIn.length > 0) {
+      const toggle = api.props.find(
+        (pr) => pr.kind === "boolean" && authored.name.toLowerCase().startsWith(pr.name.toLowerCase()) && authored.name.length > pr.name.length
+      );
+      if (toggle !== void 0 && anchorSlug !== void 0) {
+        const entry = { prop: authored.name, config: anchorSlug, props: { [toggle.name]: true } };
+        return entry;
+      }
+    }
+    return void 0;
   }).filter((x) => x !== void 0);
   const { behaviors, prelude, disclosures } = authorBehaviors(api, { ...sentinels.length > 0 ? { sentinels } : {} });
   if (dismissName !== void 0) {
-    disclosures.push(`dismiss affordance detected from the recording (layer ${JSON.stringify(dismissName)}) \u2014 onDismiss authored; dismiss-notifies-and-commits enforces the notification contract`);
+    disclosures.push(`dismiss affordance detected from the recording (${dismissName}) \u2014 onDismiss authored; dismiss-notifies-and-commits enforces the notification contract`);
   }
   for (const combo of api.syntheticCombos) {
     disclosures.push(`API split created a reachable pose with NO recorded truth: ${combo} (the design's exclusive axis cannot express it) \u2014 composed behavior only, disclosed to consumers`);
   }
   for (const slot of textSlots) {
     if (slot.varies) continue;
-    if (slot.visibleIn.length > 0) {
+    const sentineled = sentinels.some((sn) => api.props.some((pr) => pr.name === sn.prop && pr.default === slot.default));
+    if (sentineled) {
       disclosures.push(
         `constant content prop (recorded ${JSON.stringify(slot.default)}) is sentinel-checked: a behavior mounts it with a sentinel string and asserts it renders \u2014 hardcoding the recorded literal fails that check`
       );
+    } else if (slot.referencedIn.length > 0) {
+      disclosures.push(
+        `content prop (recorded ${JSON.stringify(slot.default)}) is rendered by REFERENCE in the emission but has no visibility evidence and no boolean toggle to reveal it \u2014 sentinel skipped (it could fail honest components whose pose hides the node); wire the prop anyway`
+      );
     } else {
       disclosures.push(
         `content prop from recorded text is UNEXERCISED AND UNRENDERED: NO recorded pose visibly renders ${JSON.stringify(slot.default)} (hidden node) \u2014 prescribed for completeness; wire it behind its visibility toggle; no sentinel can honestly run`
@@ -7781,7 +8041,7 @@ ALL prose instructions live ABOVE the task payload \u2014 the payload contains o
 
 ASSETS: inline the SVG assets you RENDER byte-verbatim, unchanged \u2014 never redraw or approximate an icon. Recorded assets that no scored config displays may be omitted. Two techniques reconcile that rule with reuse (both measured at 1.000): a glyph recorded once but shown in several colors keeps its bytes (fill attribute included) and is repainted with a CSS fill rule \u2014 a CSS declaration outranks an SVG presentation attribute, so one verbatim copy serves every tone; and multi-part glyphs needing fractional placement can nest each verbatim asset as a child <svg x= y=> inside one integer-origin frame (SVG user-space coordinates are exact), an alternative to the transform: scale() pattern.
 
-GEOMETRY ARBITRATION (when emission styling and the recorded box disagree, the BOX wins): Figma strokes are INSIDE the box \u2014 border+padding sums that overshoot a recorded dimension mean use an inset box-shadow or subtract the border from the padding. That rule covers strokes AT the box edge only: when a config's reference PNG is LARGER than its recorded box, the recording itself proves an OUTWARD effect \u2014 a hover ring, glow, or shadow past the frame \u2014 and the outward part is drawn outward (box-shadow spread, outline), never forced inside. On such configs the score report carries a "seat" field ({x, y} \u2014 where the recorded box sits inside the larger reference), derived from the recording's own effect geometry (shadow offset/radius/spread) \u2014 informational, so an offset shadow's asymmetric bleed is not misread as a registration error. Following strokes-inside against a padded reference contradicts the recorded pad and cost a measured five configs a full round. The harness mounts each config at its recorded box (width \xD7 height, floors not clamps); build to those dimensions, not to guessed viewports. Known rasterizer delta: Chrome often seats small text ONE PIXEL HIGHER than Figma in an identically sized box. Correct it with a PAINT-ONLY offset on those text runs \u2014 position: relative with top: 1px \u2014 never with padding or margin, which would grow the recorded box this same paragraph calls truth. TREAT IT AS A MEASUREMENT, NOT A RULE: measured cases are 12px/16px and 14px/20px needing the nudge and 14px/18px not, so font size alone does not predict it and neither does any formula we can currently defend. If small-text configs land just under the bar, apply the nudge, re-score, and keep it only if it helped. Four measured signatures, so do not expect one: on one kit it drove ink recall to 1.000; on another ink was already 1.000 and only similarity moved (mean 0.961 \u2192 0.976, four configs from 0.003 above the bar to 0.028); on a third it REGRESSED a passing bundle from 9/9 to 3/9 configs and had to be reverted; on a fourth it made every FAILING config worse too (tinted in-section surfaces: ink dropped ~0.011 across all eight configs and pushed a passing one under the bar). It is a hypothesis to score, never a default \u2014 NEVER apply it to a bundle that already passes, and when the failing family's diff shows a uniform low-density spread across the glyph band rather than a shifted band, the cause is rasterization weight, not seating: the nudge cannot help and a heavier hypothesis has no recorded truth to justify it \u2014 report the honest sub-bar result instead. Design-token NAMES in the payload are Figma names \u2014 canonicalize to valid CSS idents (lowercase kebab, e.g. "Text/text-primary" \u2192 --text-text-primary) if you emit tokens.css; literal values are equally acceptable. NEVER invent a token to satisfy a lint finding: quality findings are advisory, and a recorded value the kit has no token for is CORRECT as a literal \u2014 a made-up token name corrupts the tokens file as a record of the kit.
+GEOMETRY ARBITRATION (when emission styling and the recorded box disagree, the BOX wins): Figma strokes are INSIDE the box \u2014 border+padding sums that overshoot a recorded dimension mean use an inset box-shadow or subtract the border from the padding. That rule covers strokes AT the box edge only: when a config's reference PNG is LARGER than its recorded box, the recording itself proves an OUTWARD effect \u2014 a hover ring, glow, or shadow past the frame \u2014 and the outward part is drawn outward (box-shadow spread, outline), never forced inside. On such configs the score report carries a "seat" field ({x, y} \u2014 where the recorded box sits inside the larger reference), derived from the recording's own effect geometry (shadow offset/radius/spread) \u2014 informational, so an offset shadow's asymmetric bleed is not misread as a registration error. Following strokes-inside against a padded reference contradicts the recorded pad and cost a measured five configs a full round. The harness mounts each config at its recorded box (width \xD7 height, floors not clamps); build to those dimensions, not to guessed viewports. Known rasterizer delta: Chrome often seats small text ONE PIXEL HIGHER than Figma in an identically sized box. Correct it with a PAINT-ONLY offset on those text runs \u2014 position: relative with top: 1px \u2014 never with padding or margin, which would grow the recorded box this same paragraph calls truth. TREAT IT AS A MEASUREMENT, NOT A RULE: measured cases are 12px/16px and 14px/20px needing the nudge and 14px/18px not, so font size alone does not predict it and neither does any formula we can currently defend. RULE ORDER when both could apply (run 7: a config sat 0.0004 under the bar AND showed uniform spread \u2014 the rules pointed opposite ways): read the DIFF FIRST; the uniform-spread stop-rule below OUTRANKS the try-it rule here. Only when the diff shows a shifted band: apply the nudge, re-score, and keep it only if it helped. Four measured signatures, so do not expect one: on one kit it drove ink recall to 1.000; on another ink was already 1.000 and only similarity moved (mean 0.961 \u2192 0.976, four configs from 0.003 above the bar to 0.028); on a third it REGRESSED a passing bundle from 9/9 to 3/9 configs and had to be reverted; on a fourth it made every FAILING config worse too (tinted in-section surfaces: ink dropped ~0.011 across all eight configs and pushed a passing one under the bar). It is a hypothesis to score, never a default \u2014 NEVER apply it to a bundle that already passes, and when the failing family's diff shows a uniform low-density spread across the glyph band rather than a shifted band, the cause is rasterization weight, not seating: the nudge cannot help and a heavier hypothesis has no recorded truth to justify it \u2014 report the honest sub-bar result instead. Design-token NAMES in the payload are Figma names \u2014 canonicalize to valid CSS idents (lowercase kebab, e.g. "Text/text-primary" \u2192 --text-text-primary) if you emit tokens.css; literal values are equally acceptable. NEVER invent a token to satisfy a lint finding: quality findings are advisory, and a recorded value the kit has no token for is CORRECT as a literal \u2014 a made-up token name corrupts the tokens file as a record of the kit.
 
 RECORDED BOXES ARE TRUTH even when inconsistent: the same string may
 have different recorded widths across variants (designer resizing) \u2014 a
@@ -7869,10 +8129,10 @@ var init_brief = __esm({
 });
 
 // packages/generate/src/segments.ts
-import { existsSync as existsSync21, readFileSync as readFileSync18, readdirSync as readdirSync5 } from "node:fs";
-import path27 from "node:path";
+import { existsSync as existsSync22, readFileSync as readFileSync19, readdirSync as readdirSync6 } from "node:fs";
+import path28 from "node:path";
 function repText(set, rep, tool) {
-  const env = JSON.parse(readFileSync18(path27.join(set, rep, `${tool}.json`), "utf8"));
+  const env = JSON.parse(readFileSync19(path28.join(set, rep, `${tool}.json`), "utf8"));
   return tool === "get_design_context" ? envelopeFirstTextPart(env) : envelopeTextContent(env);
 }
 function stripFigmaInstructions(emission) {
@@ -7933,17 +8193,17 @@ DROPPED from the map, untrustworthy in the source export \u2014 for these, each
 function buildSegments(task, mode = "fenced") {
   const SET = task.set;
   let rawDefs = {};
-  if (existsSync21(path27.join(SET, "get_variable_defs.json"))) {
-    const text = envelopeFirstTextPart(JSON.parse(readFileSync18(path27.join(SET, "get_variable_defs.json"), "utf8"))) || "{}";
+  if (existsSync22(path28.join(SET, "get_variable_defs.json"))) {
+    const text = envelopeFirstTextPart(JSON.parse(readFileSync19(path28.join(SET, "get_variable_defs.json"), "utf8"))) || "{}";
     try {
       rawDefs = JSON.parse(text);
     } catch {
     }
   } else {
     for (const cfg of task.configs) {
-      const f = path27.join(SET, cfg.rep, "get_variable_defs.json");
-      if (!existsSync21(f)) continue;
-      const text = envelopeFirstTextPart(JSON.parse(readFileSync18(f, "utf8"))) || "{}";
+      const f = path28.join(SET, cfg.rep, "get_variable_defs.json");
+      if (!existsSync22(f)) continue;
+      const text = envelopeFirstTextPart(JSON.parse(readFileSync19(f, "utf8"))) || "{}";
       try {
         for (const [k, v] of Object.entries(JSON.parse(text))) rawDefs[k] ??= v;
       } catch {
@@ -7951,8 +8211,8 @@ function buildSegments(task, mode = "fenced") {
     }
   }
   const emissionTexts = task.configs.map((cfg) => {
-    const f = path27.join(SET, cfg.rep, "get_design_context.json");
-    return existsSync21(f) ? envelopeFirstTextPart(JSON.parse(readFileSync18(f, "utf8"))) : "";
+    const f = path28.join(SET, cfg.rep, "get_design_context.json");
+    return existsSync22(f) ? envelopeFirstTextPart(JSON.parse(readFileSync19(f, "utf8"))) : "";
   });
   const { map, note } = cleanTokenMap(rawDefs, emissionTexts);
   const defs = JSON.stringify(map, null, 1);
@@ -7967,9 +8227,9 @@ ${defs}
   for (const cfg of task.configs) {
     const meta = stripFigmaInstructions(repText(SET, cfg.rep, "get_metadata"));
     const emission = stripFigmaInstructions(repText(SET, cfg.rep, "get_design_context"));
-    const assets = readdirSync5(path27.join(SET, cfg.rep)).filter((f) => f.startsWith("asset-") && f.endsWith(".svg")).map((f) => `asset ${f}:
+    const assets = readdirSync6(path28.join(SET, cfg.rep)).filter((f) => f.startsWith("asset-") && f.endsWith(".svg")).map((f) => `asset ${f}:
 \`\`\`svg
-${readFileSync18(path27.join(SET, cfg.rep, f), "utf8")}
+${readFileSync19(path28.join(SET, cfg.rep, f), "utf8")}
 \`\`\``).join("\n");
     parts.push(`
 ## Config ${cfg.rep} \u2192 ${cfg.component} ${JSON.stringify(cfg.props)}
@@ -8062,8 +8322,8 @@ var init_adapter = __esm({
 
 // packages/generate/src/bundle-emit.ts
 import { createHash as createHash3 } from "node:crypto";
-import { existsSync as existsSync22, readFileSync as readFileSync19, readdirSync as readdirSync6, writeFileSync as writeFileSync10 } from "node:fs";
-import path28 from "node:path";
+import { existsSync as existsSync23, readFileSync as readFileSync20, readdirSync as readdirSync7, writeFileSync as writeFileSync11 } from "node:fs";
+import path29 from "node:path";
 function pinFromConfigs(configs) {
   const domains = /* @__PURE__ */ new Map();
   const kinds = /* @__PURE__ */ new Map();
@@ -8112,22 +8372,22 @@ function cssFontFamilies(css) {
   return [...out];
 }
 function countLatticeSymbols(setDir) {
-  const manifestFile = path28.join(setDir, "recording-set.json");
-  if (existsSync22(manifestFile)) {
+  const manifestFile = path29.join(setDir, "recording-set.json");
+  if (existsSync23(manifestFile)) {
     try {
-      const lattice = JSON.parse(readFileSync19(manifestFile, "utf8")).latticeNames;
+      const lattice = JSON.parse(readFileSync20(manifestFile, "utf8")).latticeNames;
       if (lattice !== void 0 && lattice.length > 0) return lattice.length;
     } catch {
     }
   }
   const files = [
-    path28.join(setDir, "get_metadata.json"),
-    ...existsSync22(setDir) ? readdirSync6(setDir).filter((f) => /^get_metadata-.*\.json$/.test(f)).map((f) => path28.join(setDir, f)) : []
-  ].filter((f) => existsSync22(f));
+    path29.join(setDir, "get_metadata.json"),
+    ...existsSync23(setDir) ? readdirSync7(setDir).filter((f) => /^get_metadata-.*\.json$/.test(f)).map((f) => path29.join(setDir, f)) : []
+  ].filter((f) => existsSync23(f));
   if (files.length === 0) return null;
   let count = 0;
   for (const f of files) {
-    const text = envelopeTextContent(JSON.parse(readFileSync19(f, "utf8")));
+    const text = envelopeTextContent(JSON.parse(readFileSync20(f, "utf8")));
     count += [...text.matchAll(/name="([^"]*)"/g)].filter((m) => m[1].includes("=")).length;
   }
   return count > 0 ? count : null;
@@ -8135,21 +8395,21 @@ function countLatticeSymbols(setDir) {
 function recordingSetHash(setDir, configs) {
   const relPaths = [];
   for (const name of ["recording-set.json", "completeness-manifest.json", "get_variable_defs.json", "get_metadata.json"]) {
-    if (existsSync22(path28.join(setDir, name))) relPaths.push(name);
+    if (existsSync23(path29.join(setDir, name))) relPaths.push(name);
   }
   for (const cfg of configs) {
     for (const f of ["get_design_context.json", "get_metadata.json", "get_screenshot.json", "get_variable_defs.json"]) {
-      if (existsSync22(path28.join(setDir, cfg.rep, f))) relPaths.push(`${cfg.rep}/${f}`);
+      if (existsSync23(path29.join(setDir, cfg.rep, f))) relPaths.push(`${cfg.rep}/${f}`);
     }
-    if (existsSync22(path28.join(setDir, cfg.rep))) {
-      for (const asset of readdirSync6(path28.join(setDir, cfg.rep)).filter((f) => f.startsWith("asset-"))) {
+    if (existsSync23(path29.join(setDir, cfg.rep))) {
+      for (const asset of readdirSync7(path29.join(setDir, cfg.rep)).filter((f) => f.startsWith("asset-"))) {
         relPaths.push(`${cfg.rep}/${asset}`);
       }
     }
   }
   return hashRecordingSet(
     relPaths,
-    (p) => new Uint8Array(readFileSync19(path28.join(setDir, p))),
+    (p) => new Uint8Array(readFileSync20(path29.join(setDir, p))),
     (chunks) => {
       const h = createHash3("sha256");
       for (const c of chunks) h.update(c);
@@ -8161,14 +8421,14 @@ function statusOf(s) {
   return tierOf(s, BARS.cert);
 }
 function emitBundleV1(opts) {
-  const statuses = opts.scores.map((s) => ({ rep: s.rep, similarity: s.similarity, inkRecall: s.inkRecall, status: statusOf(s) }));
+  const statuses = opts.scores.map((s) => ({ rep: s.rep, similarity: s.similarity, inkRecall: s.inkRecall, ...s.exact !== void 0 ? { exact: s.exact } : {}, status: statusOf(s) }));
   const certified = statuses.filter((s) => s.status === "certified").length;
   const pass = statuses.filter((s) => s.status !== "fail").length;
   const lattice = countLatticeSymbols(opts.task.set);
   const interaction = opts.behaviors.filter((b) => !b.id.startsWith("prelude:"));
   const prelude = opts.behaviors.filter((b) => b.id.startsWith("prelude:"));
-  const cssFiles = ["styles.css", "tokens.css"].map((f) => path28.join(opts.bundleDir, f)).filter((f) => existsSync22(f));
-  const families = cssFontFamilies(cssFiles.map((f) => readFileSync19(f, "utf8")).join("\n"));
+  const cssFiles = ["styles.css", "tokens.css"].map((f) => path29.join(opts.bundleDir, f)).filter((f) => existsSync23(f));
+  const families = cssFontFamilies(cssFiles.map((f) => readFileSync20(f, "utf8")).join("\n"));
   const requiredFonts = requiredFontsManifest(families, opts.fontCacheDir).map((f) => ({
     family: f.family,
     weight: f.weight,
@@ -8197,7 +8457,7 @@ function emitBundleV1(opts) {
         // resolvable via verify's --set override).
         path: (() => {
           const base = process.env["INIT_CWD"] ?? process.cwd();
-          const rel = path28.relative(base, opts.task.set);
+          const rel = path29.relative(base, opts.task.set);
           return rel !== "" && !rel.startsWith("..") ? rel : opts.task.set;
         })(),
         component: opts.componentName,
@@ -8221,16 +8481,16 @@ function emitBundleV1(opts) {
     })
   };
   const written = [];
-  const manifestPath2 = path28.join(opts.bundleDir, "component.json");
-  writeFileSync10(manifestPath2, `${JSON.stringify(manifest, null, 2)}
+  const manifestPath2 = path29.join(opts.bundleDir, "component.json");
+  writeFileSync11(manifestPath2, `${JSON.stringify(manifest, null, 2)}
 `);
   written.push(manifestPath2);
-  const stylesPath = path28.join(opts.bundleDir, "styles.css");
-  if (existsSync22(stylesPath)) {
+  const stylesPath = path29.join(opts.bundleDir, "styles.css");
+  if (existsSync23(stylesPath)) {
     const comment = cssProvenanceComment({ pass, scored: statuses.length, certified, latticeConfigs: lattice });
-    const current = readFileSync19(stylesPath, "utf8");
+    const current = readFileSync20(stylesPath, "utf8");
     const stripped = current.replace(/^\/\* tendril bundle v\d+ [^]*?\*\/\n/, "");
-    writeFileSync10(stylesPath, `${comment}
+    writeFileSync11(stylesPath, `${comment}
 ${stripped}`);
     written.push(stylesPath);
   }
@@ -8278,8 +8538,8 @@ __export(fonts_exports, {
   runFontsResolveSet: () => runFontsResolveSet,
   runFontsStatus: () => runFontsStatus
 });
-import { existsSync as existsSync23, readFileSync as readFileSync20 } from "node:fs";
-import path29 from "node:path";
+import { existsSync as existsSync24, readFileSync as readFileSync21 } from "node:fs";
+import path30 from "node:path";
 async function runFontsResolve(opts) {
   const result = await resolveFonts(opts.family, opts.weights, opts.cacheDir);
   emitData(opts, result, () => {
@@ -8294,7 +8554,7 @@ async function runFontsResolve(opts) {
   }
 }
 async function runFontsResolveSet(opts) {
-  const setDir = path29.resolve(process.env["INIT_CWD"] ?? process.cwd(), opts.set);
+  const setDir = path30.resolve(process.env["INIT_CWD"] ?? process.cwd(), opts.set);
   let needs = [];
   try {
     needs = recordedFontNeeds(setDir);
@@ -8343,16 +8603,16 @@ async function runFontsResolveSet(opts) {
   }
 }
 function runFontsStatus(opts) {
-  const manifestPath2 = path29.join(opts.cacheDir, "manifest.json");
-  if (!existsSync23(manifestPath2)) {
+  const manifestPath2 = path30.join(opts.cacheDir, "manifest.json");
+  if (!existsSync24(manifestPath2)) {
     fail(opts, ExitCode.FontsUnproven, {
       error: `no font cache at ${opts.cacheDir}`,
       code: "fonts-unresolved",
       remediation: 'Run `tendril fonts resolve --set <recording-dir>` (or `tendril fonts resolve "<Family>" --weights 400 500 600`) first.'
     });
   }
-  const faces = JSON.parse(readFileSync20(manifestPath2, "utf8"));
-  const lockVerdicts = opts.lock !== void 0 ? checkFontLock(path29.resolve(opts.lock), opts.cacheDir) : null;
+  const faces = JSON.parse(readFileSync21(manifestPath2, "utf8"));
+  const lockVerdicts = opts.lock !== void 0 ? checkFontLock(path30.resolve(opts.lock), opts.cacheDir) : null;
   emitData(opts, { faces, lockVerdicts }, () => {
     for (const f of faces) process.stdout.write(`cached ${f.family} ${f.weight} (${f.sha256.slice(0, 12)}\u2026)
 `);
@@ -8437,8 +8697,8 @@ __export(verify_exports, {
   interactionCoverage: () => interactionCoverage,
   runVerify: () => runVerify
 });
-import { existsSync as existsSync24, readFileSync as readFileSync21 } from "node:fs";
-import path30 from "node:path";
+import { existsSync as existsSync25, readFileSync as readFileSync22 } from "node:fs";
+import path31 from "node:path";
 function interactionCoverage(behaviors) {
   const interaction = behaviors.filter((b) => !b.id.startsWith("prelude:"));
   return {
@@ -8453,7 +8713,7 @@ function taskFromManifest(opts, manifest, setDir) {
   const adapterSlugs = Object.keys(manifest.propAdapter);
   const unmapped = recordedSlugs.filter((s) => !adapterSlugs.includes(s));
   const adapterOnly = adapterSlugs.filter((s) => !recordedSlugs.includes(s));
-  const registry = Object.values(TASKS).find((t) => path30.resolve(t.set) === path30.resolve(setDir));
+  const registry = Object.values(TASKS).find((t) => path31.resolve(t.set) === path31.resolve(setDir));
   const authored = (() => {
     if (registry !== void 0) return void 0;
     try {
@@ -8485,19 +8745,19 @@ function taskFromManifest(opts, manifest, setDir) {
 }
 async function runVerify(opts) {
   const callerCwd = process.env["INIT_CWD"] ?? process.cwd();
-  const setOverride = opts.set !== void 0 ? path30.resolve(callerCwd, opts.set) : void 0;
-  opts = { ...opts, bundleDir: path30.resolve(callerCwd, opts.bundleDir), ...setOverride !== void 0 ? { set: setOverride } : {} };
-  if (!existsSync24(opts.bundleDir)) {
+  const setOverride = opts.set !== void 0 ? path31.resolve(callerCwd, opts.set) : void 0;
+  opts = { ...opts, bundleDir: path31.resolve(callerCwd, opts.bundleDir), ...setOverride !== void 0 ? { set: setOverride } : {} };
+  if (!existsSync25(opts.bundleDir)) {
     fail(opts, ExitCode.InputValidation, {
       error: `bundle directory not found: ${opts.bundleDir}`,
       code: "bundle-missing",
       remediation: "Point at a generated bundle directory (containing component.json, the entry module, and styles.css)."
     });
   }
-  const manifestPath2 = path30.join(opts.bundleDir, "component.json");
+  const manifestPath2 = path31.join(opts.bundleDir, "component.json");
   let manifest;
-  if (existsSync24(manifestPath2)) {
-    const { manifest: parsed, issues } = readBundleManifest(readFileSync21(manifestPath2, "utf8"));
+  if (existsSync25(manifestPath2)) {
+    const { manifest: parsed, issues } = readBundleManifest(readFileSync22(manifestPath2, "utf8"));
     if (issues.length > 0) {
       fail(opts, ExitCode.InputValidation, {
         error: `bundle manifest rejected at ingest: ${issues.map((i) => i.message).join("; ")}`,
@@ -8524,21 +8784,21 @@ async function runVerify(opts) {
     task = registry;
   } else if (manifest !== void 0) {
     const resolveSetDir = (p) => {
-      if (path30.isAbsolute(p)) return p;
-      const fromRepo = path30.resolve(REPO_ROOT, p);
-      if (existsSync24(fromRepo)) return fromRepo;
-      return path30.resolve(callerCwd, p);
+      if (path31.isAbsolute(p)) return p;
+      const fromRepo = path31.resolve(REPO_ROOT, p);
+      if (existsSync25(fromRepo)) return fromRepo;
+      return path31.resolve(callerCwd, p);
     };
     const setDir = opts.set ?? resolveSetDir(manifest.provenance.recordingSet.path);
-    if (!existsSync24(path30.join(setDir, "recording-set.json")) && !Object.values(TASKS).some((t) => path30.resolve(t.set) === path30.resolve(setDir))) {
+    if (!existsSync25(path31.join(setDir, "recording-set.json")) && !Object.values(TASKS).some((t) => path31.resolve(t.set) === path31.resolve(setDir))) {
       fail(opts, ExitCode.RecordingIncomplete, {
         error: `recording set not found or unmanifested: ${setDir}`,
         code: "recording-set-missing",
         remediation: "Pass --set <dir> pointing at the recording set this bundle was generated from."
       });
     }
-    const registry = Object.values(TASKS).find((t) => path30.resolve(t.set) === path30.resolve(setDir));
-    if (registry !== void 0 && !existsSync24(path30.join(setDir, "recording-set.json"))) {
+    const registry = Object.values(TASKS).find((t) => path31.resolve(t.set) === path31.resolve(setDir));
+    if (registry !== void 0 && !existsSync25(path31.join(setDir, "recording-set.json"))) {
       const recordedSlugs = registry.configs.map((c) => c.rep);
       const adapterSlugs = Object.keys(manifest.propAdapter);
       unmapped = recordedSlugs.filter((s) => !adapterSlugs.includes(s));
@@ -8562,9 +8822,9 @@ async function runVerify(opts) {
       warn(opts, `recording set content differs from the bundle's provenance stamp (${hash.slice(0, 12)}\u2026 vs ${manifest.provenance.recordingSet.hash.slice(0, 12)}\u2026) \u2014 scores apply to the CURRENT set`);
     }
     for (const name of [manifest.entry, "styles.css", "tokens.css"]) {
-      const p = path30.join(opts.bundleDir, name);
-      if (!existsSync24(p)) continue;
-      const issues = checkBundleSourceFile(name, new Uint8Array(readFileSync21(p)));
+      const p = path31.join(opts.bundleDir, name);
+      if (!existsSync25(p)) continue;
+      const issues = checkBundleSourceFile(name, new Uint8Array(readFileSync22(p)));
       if (issues.length > 0) {
         fail(opts, ExitCode.InputValidation, {
           error: `bundle source rejected at ingest: ${issues.map((i) => i.message).join("; ")}`,
@@ -8588,7 +8848,7 @@ async function runVerify(opts) {
     });
   }
   const missing = task.configs.filter(
-    (c) => !existsSync24(path30.join(task.set, c.rep, "get_screenshot.json")) || !existsSync24(path30.join(task.set, c.rep, "get_metadata.json"))
+    (c) => !existsSync25(path31.join(task.set, c.rep, "get_screenshot.json")) || !existsSync25(path31.join(task.set, c.rep, "get_metadata.json"))
   );
   if (missing.length > 0) {
     fail(opts, ExitCode.RecordingIncomplete, {
@@ -8598,10 +8858,10 @@ async function runVerify(opts) {
     });
   }
   const bar = BARS2[opts.bar];
-  const evidenceDir = path30.join(opts.bundleDir, "verify-evidence");
+  const evidenceDir = path31.join(opts.bundleDir, "verify-evidence");
   const scores = await scoreBundleForTask(task, opts.bundleDir, bar, { evidenceDir, onProgress: emitProgress });
   const quality = await checkBundleQuality(opts.bundleDir, task.entry);
-  const bundleCss = ["tokens.css", "styles.css"].map((f) => path30.join(opts.bundleDir, f)).filter((f) => existsSync24(f)).map((f) => readFileSync21(f, "utf8")).join("\n");
+  const bundleCss = ["tokens.css", "styles.css"].map((f) => path31.join(opts.bundleDir, f)).filter((f) => existsSync25(f)).map((f) => readFileSync22(f, "utf8")).join("\n");
   const occlusion = await checkSiblingOcclusion(task, opts.bundleDir, bundleCss);
   const parity = await checkHoverParity(task, opts.bundleDir);
   const behaviors = [...await checkBehaviors(task, opts.bundleDir), ...parity];
@@ -8818,18 +9078,18 @@ __export(engine_exports, {
   runEngineBrief: () => runEngineBrief,
   runEngineScore: () => runEngineScore
 });
-import { existsSync as existsSync25, mkdirSync as mkdirSync6, readFileSync as readFileSync22, writeFileSync as writeFileSync11 } from "node:fs";
-import path31 from "node:path";
+import { existsSync as existsSync26, mkdirSync as mkdirSync7, readFileSync as readFileSync23, writeFileSync as writeFileSync12 } from "node:fs";
+import path32 from "node:path";
 function resolveEngineTask(opts, callerCwd) {
-  const asPath = path31.resolve(callerCwd, opts.taskOrSet);
-  const isSet = existsSync25(path31.join(asPath, "recording-set.json"));
+  const asPath = path32.resolve(callerCwd, opts.taskOrSet);
+  const isSet = existsSync26(path32.join(asPath, "recording-set.json"));
   const registry = TASKS[opts.taskOrSet];
   if (registry !== void 0 && !isSet) return { task: registry, name: opts.taskOrSet };
   if (isSet) {
     try {
       const authored = authorTaskFromSet(asPath);
       for (const d of authored.disclosures) warn(opts, d);
-      return { task: authored.task, name: path31.basename(asPath), apiPin: { props: authored.api.apiPin.props, forcedStates: authored.api.apiPin.forcedStates } };
+      return { task: authored.task, name: path32.basename(asPath), apiPin: { props: authored.api.apiPin.props, forcedStates: authored.api.apiPin.forcedStates } };
     } catch (err) {
       fail(opts, ExitCode.InputValidation, {
         error: `cannot author a task from ${asPath}: ${err instanceof Error ? err.message.split("\n")[0] : String(err)}`,
@@ -8845,15 +9105,16 @@ function resolveEngineTask(opts, callerCwd) {
   });
 }
 function runEngineBrief(opts) {
+  requireEntitlement(opts);
   const callerCwd = process.env["INIT_CWD"] ?? process.cwd();
   const { task, name } = resolveEngineTask(opts, callerCwd);
   const bar = BARS3[opts.bar];
   const brief = buildBrief(task.systemApi, bar, { colorScheme: recordingIsDark(task) ? "dark" : "light" });
   const segments = buildSegments(task, "files");
   let notRecorded;
-  const manifestPath2 = path31.join(task.set, "recording-set.json");
-  if (existsSync25(manifestPath2)) {
-    notRecorded = JSON.parse(readFileSync22(manifestPath2, "utf8")).notRecorded;
+  const manifestPath2 = path32.join(task.set, "recording-set.json");
+  if (existsSync26(manifestPath2)) {
+    notRecorded = JSON.parse(readFileSync23(manifestPath2, "utf8")).notRecorded;
   }
   const unverified = notRecorded !== void 0 && notRecorded !== "" ? `
 
@@ -8861,7 +9122,7 @@ function runEngineBrief(opts) {
 DO NOT INVENT PIXELS FOR THESE POSES. Implement them ONLY as the composition of recorded per-axis truth (the custom-property composition rule: one paint axis sets variables, the other consumes) and list every such pose in your report as UNRECORDED-COMPOSED. Recording them is the real fix: re-plan the set (full matrix is the default) and record the missing poses.
 ${notRecorded}` : "";
   let fontProvisioning;
-  if (existsSync25(manifestPath2)) {
+  if (existsSync26(manifestPath2)) {
     const provided = resolvedFontFamilies().map((f) => f.family);
     const unprovided = recordedFontFamilies(task.set).filter((r) => !provided.some((p) => p.toLowerCase() === r.toLowerCase()));
     if (unprovided.length > 0) {
@@ -8883,9 +9144,9 @@ ${notRecorded}` : "";
 
 === TASK PAYLOAD (recorded truth, verbatim) ===
 ${segments}`;
-  const payloadFile = path31.resolve(callerCwd, opts.out ?? `tendril-out/${name}-brief.md`);
-  mkdirSync6(path31.dirname(payloadFile), { recursive: true });
-  writeFileSync11(payloadFile, payload);
+  const payloadFile = path32.resolve(callerCwd, opts.out ?? `tendril-out/${name}-brief.md`);
+  mkdirSync7(path32.dirname(payloadFile), { recursive: true });
+  writeFileSync12(payloadFile, payload);
   emitData(
     opts,
     {
@@ -8927,10 +9188,11 @@ ${segments}`;
   );
 }
 async function runEngineScore(opts) {
+  requireEntitlement(opts);
   const callerCwd = process.env["INIT_CWD"] ?? process.cwd();
-  const candidateDir = path31.resolve(callerCwd, opts.candidateDir);
+  const candidateDir = path32.resolve(callerCwd, opts.candidateDir);
   const { task, name, apiPin } = resolveEngineTask(opts, callerCwd);
-  if (!existsSync25(candidateDir)) {
+  if (!existsSync26(candidateDir)) {
     fail(opts, ExitCode.InputValidation, {
       error: `candidate directory not found: ${candidateDir}`,
       code: "candidate-missing",
@@ -8944,10 +9206,10 @@ async function runEngineScore(opts) {
       remediation: fontsUnprovenRemediation(task.set)
     });
   }
-  if (opts.rebind !== true && existsSync25(path31.join(candidateDir, "component.json"))) {
+  if (opts.rebind !== true && existsSync26(path32.join(candidateDir, "component.json"))) {
     const prior = (() => {
       try {
-        const read = readBundleManifest(readFileSync22(path31.join(candidateDir, "component.json"), "utf8"));
+        const read = readBundleManifest(readFileSync23(path32.join(candidateDir, "component.json"), "utf8"));
         return read.manifest === void 0 ? { unreadable: true } : { hash: read.manifest.provenance.recordingSet.hash, path: read.manifest.provenance.recordingSet.path };
       } catch {
         return { unreadable: true };
@@ -8969,7 +9231,7 @@ async function runEngineScore(opts) {
     }
   }
   const bar = BARS3[opts.bar];
-  const evidenceDir = path31.join(candidateDir, "verify-evidence");
+  const evidenceDir = path32.join(candidateDir, "verify-evidence");
   const scores = await scoreBundleForTask(task, candidateDir, bar, { evidenceDir, onProgress: emitProgress });
   const parity = await checkHoverParity(task, candidateDir);
   const behaviors = [...await checkBehaviors(task, candidateDir), ...parity];
@@ -8984,11 +9246,16 @@ ${[
     ...quality.findings.map((f) => `- ${f.kind} ${f.file}${f.line === void 0 ? "" : `:${f.line}`} \u2014 ${f.message}`),
     ...quality.tokensAbsent ? ["- no design tokens: no tokens.css and no var(--\u2026) reference; every value is hardcoded"] : []
   ].join("\n")}`;
-  const feedback = buildFeedback(scores, behaviors, bar, "files") + qualityFeedback;
   const allPass = obj[0] === total && total > 0;
   const certBar = BARS3["cert"];
-  const certifiedReps = scores.filter((sc) => sc.similarity >= certBar.sim && sc.inkRecall >= certBar.ink).map((sc) => sc.rep);
+  const parityDemoted = new Set(parity.filter((p) => !p.pass).map((p) => p.id.replace(/^parity:/, "")));
+  const certifiedReps = scores.filter((sc) => tierOf(sc, certBar) === "certified" && !parityDemoted.has(sc.rep)).map((sc) => sc.rep);
   const certifiedSet = new Set(certifiedReps);
+  const certificationFeedback = `
+
+CERTIFICATION: ${certifiedReps.length}/${scores.length} configs at the certification bar (sim \u2265${certBar.sim} AND ink \u2265${certBar.ink}, exact values, after parity demotion \u2014 composition checks at verify can demote further).${certifiedReps.length < scores.length ? ` Below cert: ${scores.filter((sc) => !certifiedSet.has(sc.rep)).map((sc) => sc.rep).join(", ")}.` : ""}
+METRIC DEADBAND (read before iterating on near-misses): the scored similarity/ink deliberately tolerate \xB11px edge shift and antialiased-edge differences \u2014 cross-rasterizer noise absorption. A change entirely inside that band moves these numbers by EXACTLY ZERO (working as designed, not a stuck scorer). The per-config \`exact\` fields in the JSON are tolerance-free and move first: compare exact across rounds to confirm a small fix landed, and stop iterating when only exact moves \u2014 the bar reads the tolerant numbers.`;
+  const feedback = buildFeedback(scores, behaviors, bar, "files") + certificationFeedback + qualityFeedback;
   const emitted = emitBundleV1({
     bundleDir: candidateDir,
     task,
@@ -9019,7 +9286,7 @@ ${[
       bundleManifest: emitted.written[0],
       note: "styles.css was stamped with the bundle provenance comment on line 1 \u2014 preserve it in any post-score edit",
       allPass,
-      certification: { certified: certifiedReps.length, total, bar: certBar }
+      certification: { certified: certifiedReps.length, total: scores.length, bar: certBar, note: "tierOf on exact values + parity demotion; verify's composition checks can demote further" }
     },
     () => {
       for (const s of scores) process.stdout.write(`${s.pass ? certifiedSet.has(s.rep) ? "CERT" : "PASS" : "FAIL"} ${s.rep}: sim=${s.similarity} ink=${s.inkRecall}${s.error !== void 0 ? ` [${s.error}]` : ""}
@@ -9049,7 +9316,9 @@ var init_engine2 = __esm({
     init_font_guidance();
     init_src4();
     init_output();
+    init_entitlement();
     init_verify();
+    init_src4();
     BARS3 = {
       pass: { sim: 0.95, ink: 0.95 },
       cert: { sim: 0.97, ink: 0.95 }
@@ -9062,11 +9331,11 @@ var codeconnect_exports = {};
 __export(codeconnect_exports, {
   runCodeConnect: () => runCodeConnect
 });
-import { existsSync as existsSync26, readFileSync as readFileSync23, writeFileSync as writeFileSync12 } from "node:fs";
-import path32 from "node:path";
+import { existsSync as existsSync27, readFileSync as readFileSync24, writeFileSync as writeFileSync13 } from "node:fs";
+import path33 from "node:path";
 function runCodeConnect(opts) {
   const callerCwd = process.env["INIT_CWD"] ?? process.cwd();
-  const bundleDir = path32.resolve(callerCwd, opts.bundleDir);
+  const bundleDir = path33.resolve(callerCwd, opts.bundleDir);
   let url;
   try {
     url = new URL(opts.figmaUrl);
@@ -9082,7 +9351,7 @@ function runCodeConnect(opts) {
   }
   let manifest;
   try {
-    const read = readBundleManifest(readFileSync23(path32.join(bundleDir, "component.json"), "utf8"));
+    const read = readBundleManifest(readFileSync24(path33.join(bundleDir, "component.json"), "utf8"));
     if (read.manifest === void 0) throw new Error(read.issues.map((i) => i.message).join("; ") || "no component.json");
     manifest = read.manifest;
   } catch (err) {
@@ -9092,8 +9361,8 @@ function runCodeConnect(opts) {
       remediation: "Point at a bundle produced by the Tendril pipeline (it carries component.json), and verify it first."
     });
   }
-  const setDir = path32.resolve(callerCwd, opts.set ?? manifest.provenance.recordingSet.path);
-  if (!existsSync26(path32.join(setDir, "recording-set.json"))) {
+  const setDir = path33.resolve(callerCwd, opts.set ?? manifest.provenance.recordingSet.path);
+  if (!existsSync27(path33.join(setDir, "recording-set.json"))) {
     fail(opts, ExitCode.InputValidation, {
       error: `recording set not found at ${setDir}`,
       code: "codeconnect-no-set",
@@ -9114,10 +9383,10 @@ function runCodeConnect(opts) {
   const component = api.component;
   const recManifest = loadManifest(setDir);
   const poseNames = recManifest.latticeNames ?? recManifest.reps.map((r) => {
-    const meta = path32.join(setDir, r.slug, "get_metadata.json");
-    if (!existsSync26(meta)) return void 0;
+    const meta = path33.join(setDir, r.slug, "get_metadata.json");
+    if (!existsSync27(meta)) return void 0;
     try {
-      return /name="([^"]*)"/.exec(envelopeFirstTextPart(JSON.parse(readFileSync23(meta, "utf8"))))?.[1];
+      return /name="([^"]*)"/.exec(envelopeFirstTextPart(JSON.parse(readFileSync24(meta, "utf8"))))?.[1];
     } catch {
       return void 0;
     }
@@ -9175,7 +9444,7 @@ function runCodeConnect(opts) {
     axisLines.push(`const ${varName} = instance.getEnum(${q(axis)}, { ${entries.join(", ")} })`);
     fragmentVars.push(varName);
   }
-  const entryRel = path32.relative(callerCwd, path32.join(bundleDir, manifest.entry));
+  const entryRel = path33.relative(callerCwd, path33.join(bundleDir, manifest.entry));
   const trust = manifest.trustStatement.split("\n")[0] ?? "";
   const lines = [
     `// url=${opts.figmaUrl}`,
@@ -9196,8 +9465,8 @@ function runCodeConnect(opts) {
     `}`,
     ``
   ].join("\n");
-  const outFile = path32.resolve(callerCwd, opts.out ?? path32.join(bundleDir, `${component}.figma.ts`));
-  writeFileSync12(outFile, lines);
+  const outFile = path33.resolve(callerCwd, opts.out ?? path33.join(bundleDir, `${component}.figma.ts`));
+  writeFileSync13(outFile, lines);
   emitData(
     opts,
     {
@@ -9257,17 +9526,17 @@ __export(generate_recorded_exports, {
   runGenerateRecorded: () => runGenerateRecorded
 });
 import { confirm as confirm3, isCancel as isCancel3 } from "@clack/prompts";
-import { existsSync as existsSync27, readFileSync as readFileSync24 } from "node:fs";
-import path33 from "node:path";
+import { existsSync as existsSync28, readFileSync as readFileSync25 } from "node:fs";
+import path34 from "node:path";
 async function runGenerateRecorded(opts) {
   const callerCwd = process.env["INIT_CWD"] ?? process.cwd();
-  const outDirAbs = path33.resolve(callerCwd, opts.out);
-  const recordedAsPath = path33.resolve(callerCwd, opts.recorded);
+  const outDirAbs = path34.resolve(callerCwd, opts.out);
+  const recordedAsPath = path34.resolve(callerCwd, opts.recorded);
   let task;
   let taskName;
   let authoredApi;
   let composition;
-  const isSet = existsSync27(path33.join(recordedAsPath, "recording-set.json"));
+  const isSet = existsSync28(path34.join(recordedAsPath, "recording-set.json"));
   const registry = TASKS[opts.recorded];
   if (registry !== void 0 && !isSet) {
     task = registry;
@@ -9276,7 +9545,7 @@ async function runGenerateRecorded(opts) {
     try {
       const authored = authorTaskFromSet(recordedAsPath);
       task = authored.task;
-      taskName = path33.basename(recordedAsPath);
+      taskName = path34.basename(recordedAsPath);
       authoredApi = authored.api;
       const roles = RolesSchema.safeParse(loadManifest(recordedAsPath).roles);
       if (roles.success) composition = roles.data;
@@ -9303,7 +9572,7 @@ async function runGenerateRecorded(opts) {
     });
   }
   const missing = task.configs.filter(
-    (c) => !existsSync27(path33.join(task.set, c.rep, "get_screenshot.json")) || !existsSync27(path33.join(task.set, c.rep, "get_metadata.json")) || !existsSync27(path33.join(task.set, c.rep, "get_design_context.json"))
+    (c) => !existsSync28(path34.join(task.set, c.rep, "get_screenshot.json")) || !existsSync28(path34.join(task.set, c.rep, "get_metadata.json")) || !existsSync28(path34.join(task.set, c.rep, "get_design_context.json"))
   );
   if (missing.length > 0) {
     fail(opts, ExitCode.RecordingIncomplete, {
@@ -9373,8 +9642,8 @@ async function runGenerateRecorded(opts) {
 ` : `${line}
 `);
   if (opts.dryRun) {
-    emitData(opts, { dryRun: true, task: taskName, model: modelId, consent, wouldWrite: path33.join(outDirAbs, taskName) }, () => {
-      process.stdout.write(`dry-run: nothing sent, nothing written (would write ${path33.join(outDirAbs, taskName)})
+    emitData(opts, { dryRun: true, task: taskName, model: modelId, consent, wouldWrite: path34.join(outDirAbs, taskName) }, () => {
+      process.stdout.write(`dry-run: nothing sent, nothing written (would write ${path34.join(outDirAbs, taskName)})
 `);
     });
     return;
@@ -9397,10 +9666,10 @@ async function runGenerateRecorded(opts) {
       });
     }
   }
-  const bundleDir = path33.join(outDirAbs, taskName);
-  if (existsSync27(path33.join(bundleDir, "component.json"))) {
+  const bundleDir = path34.join(outDirAbs, taskName);
+  if (existsSync28(path34.join(bundleDir, "component.json"))) {
     try {
-      const prior = readBundleManifest(readFileSync24(path33.join(bundleDir, "component.json"), "utf8")).manifest;
+      const prior = readBundleManifest(readFileSync25(path34.join(bundleDir, "component.json"), "utf8")).manifest;
       if (prior !== void 0 && prior.provenance.recordingSet.hash !== recordingSetHash(task.set, task.configs)) {
         fail(opts, ExitCode.InputValidation, {
           error: `${bundleDir} already holds a bundle bound to recording set "${prior.provenance.recordingSet.path}" \u2014 generating here against a different set would silently rewrite its verification identity`,
@@ -9536,8 +9805,9 @@ import { Command } from "commander";
 // packages/cli/src/commands/doctor.ts
 init_src4();
 init_src();
-import { existsSync as existsSync16, readFileSync as readFileSync13 } from "node:fs";
-import path21 from "node:path";
+import { existsSync as existsSync17, readFileSync as readFileSync14, readdirSync as readdirSync3 } from "node:fs";
+import os4 from "node:os";
+import path22 from "node:path";
 
 // packages/cli/src/describe.ts
 var COMMON_EXIT_CODES = {
@@ -9556,6 +9826,7 @@ function printDescription(description) {
 init_env();
 init_environment();
 init_output();
+init_entitlement();
 var DEFAULT_MCP_URL = "http://127.0.0.1:3845/mcp";
 var DOCTOR_DESCRIPTION = {
   name: "doctor",
@@ -9615,15 +9886,38 @@ async function runDoctorChecks(options) {
       remediation: "Install Google Chrome (or Chromium), or set CHROME_PATH to a Chromium-family browser binary."
     });
   }
-  const fontManifest = path21.join(fontCacheDir(), "manifest.json");
+  const fontManifest = path22.join(fontCacheDir(), "manifest.json");
   checks.push(
-    existsSync16(fontManifest) ? { name: "font-cache", ok: true, detail: `resolved font cache at ${fontCacheDir()} (${JSON.parse(readFileSync13(fontManifest, "utf8")).length} faces)` } : {
+    existsSync17(fontManifest) ? { name: "font-cache", ok: true, detail: `resolved font cache at ${fontCacheDir()} (${JSON.parse(readFileSync14(fontManifest, "utf8")).length} faces)` } : {
       name: "font-cache",
       ok: true,
       detail: `font cache empty at ${fontCacheDir()} \u2014 normal on a fresh machine; faces resolve per design system at first use`,
       remediation: "Nothing to do now: `tendril fonts resolve --set <recording-dir>` fetches exactly what a recording declares, and generate/verify name that command when they need it."
     }
   );
+  const pluginRoot = path22.join(os4.homedir(), ".claude", "plugins", "cache", "tendrilapp", "tendril");
+  if (existsSync17(pluginRoot)) {
+    try {
+      const versions = readdirSync3(pluginRoot).filter((v) => /^\d+\.\d+\.\d+$/.test(v));
+      const newest = versions.sort((a, b) => versionIsNewer(a, b) ? 1 : -1)[0];
+      if (newest !== void 0) {
+        const skewed = versionIsNewer(newest, cliVersion());
+        checks.push(
+          skewed ? {
+            name: "plugin-skew",
+            ok: false,
+            detail: `Claude Code plugin cache holds v${newest} while this CLI is ${cliVersion()} \u2014 the plugin's skill/agents are STALE and will silently shadow current doctrine`,
+            remediation: "Update the plugin \u2014 REFRESH THE MARKETPLACE FIRST (its local clone goes stale and a reinstall faithfully reinstalls the old version): terminal Claude Code \u2014 `claude plugin marketplace update tendrilapp` then `claude plugin update tendril`; VS Code extension \u2014 /plugins panel \u2192 Marketplaces tab \u2192 refresh tendrilapp, THEN Plugins tab \u2192 uninstall + reinstall tendril, reopen the chat panel. If the refresh doesn't take, remove the tendrilapp marketplace entirely and re-add TendrilApp/claude-plugin (a fresh clone cannot be stale)."
+          } : { name: "plugin-skew", ok: true, detail: `Claude Code plugin v${newest} matches this CLI` }
+        );
+      }
+    } catch {
+    }
+  }
+  const ent = checkEntitlement();
+  checks.push(
+    ent.ok ? ent.mode === "pre-launch" ? { name: "entitlement", ok: true, detail: "pre-launch build \u2014 entitlement gates present but unarmed (no public key shipped); record/generate run freely" } : { name: "entitlement", ok: true, detail: `active plan "${ent.claims.plan}" until ${new Date(ent.claims.exp).toISOString().slice(0, 10)}${ent.stale ? " (stale \u2014 renews at next opportunity)" : ""}` } : { name: "entitlement", ok: false, detail: ent.error, remediation: ent.remediation }
+  );
   const figmaToken = resolveCredential("FIGMA_TOKEN");
   checks.push({
     name: "figma-pat",
@@ -9692,7 +9986,7 @@ async function runDoctor(flags) {
 init_src3();
 import { intro, isCancel, outro, password } from "@clack/prompts";
 import fs from "node:fs";
-import path22 from "node:path";
+import path23 from "node:path";
 init_env();
 init_output();
 var INIT_DESCRIPTION = {
@@ -9731,7 +10025,7 @@ async function runInit(flags) {
     printDescription(INIT_DESCRIPTION);
     return;
   }
-  const envPath = path22.resolve(process.cwd(), ".env");
+  const envPath = path23.resolve(process.cwd(), ".env");
   const existing = fs.existsSync(envPath) ? parseEnv(fs.readFileSync(envPath, "utf8")) : /* @__PURE__ */ new Map();
   let figmaToken = flags.figmaToken ?? existing.get(ENV_KEYS.figma);
   let openrouterKey = flags.openrouterKey ?? existing.get(ENV_KEYS.openrouter);
@@ -9752,7 +10046,7 @@ async function runInit(flags) {
   next.set(ENV_KEYS.figma, figmaToken);
   next.set(ENV_KEYS.openrouter, openrouterKey);
   const changed = existing.get(ENV_KEYS.figma) !== next.get(ENV_KEYS.figma) || existing.get(ENV_KEYS.openrouter) !== next.get(ENV_KEYS.openrouter);
-  const gitignorePath = path22.resolve(process.cwd(), ".gitignore");
+  const gitignorePath = path23.resolve(process.cwd(), ".gitignore");
   const gitignore = fs.existsSync(gitignorePath) ? fs.readFileSync(gitignorePath, "utf8") : "";
   const gitignoreCoversEnv = gitignore.split("\n").some((line) => [".env", ".env", ".env*"].includes(line.trim()));
   if (flags.dryRun) {
@@ -9803,16 +10097,17 @@ init_src();
 init_src5();
 init_src2();
 import { confirm as confirm2, isCancel as isCancel2 } from "@clack/prompts";
-import { readFileSync as readFileSync14, readdirSync as readdirSync3, existsSync as existsSync17 } from "node:fs";
+import { readFileSync as readFileSync15, readdirSync as readdirSync4, existsSync as existsSync18 } from "node:fs";
 init_env();
 init_output();
+init_entitlement();
 
 // packages/cli/src/pipeline.ts
 init_src2();
 init_src4();
 init_src6();
-import { mkdirSync as mkdirSync4, writeFileSync as writeFileSync7 } from "node:fs";
-import path23 from "node:path";
+import { mkdirSync as mkdirSync5, writeFileSync as writeFileSync8 } from "node:fs";
+import path24 from "node:path";
 
 // packages/cli/src/assets-module.ts
 init_src();
@@ -10148,8 +10443,8 @@ async function runGenerationPipeline(input) {
   });
   const written = [];
   if (!input.dryRun) {
-    const dir = path23.resolve(input.outDir, semantics.componentName);
-    mkdirSync4(dir, { recursive: true });
+    const dir = path24.resolve(input.outDir, semantics.componentName);
+    mkdirSync5(dir, { recursive: true });
     const files = {
       // Bundle-local tokens: THE emission the component's CSS resolves
       // against — the same artifact the verify harness injects. A preview
@@ -10172,14 +10467,14 @@ async function runGenerationPipeline(input) {
 `
     };
     for (const [name, content] of Object.entries(files)) {
-      const filePath = path23.join(dir, name);
-      writeFileSync7(filePath, content);
+      const filePath = path24.join(dir, name);
+      writeFileSync8(filePath, content);
       written.push(filePath);
     }
     for (const artifact of emitTokenArtifacts(input.mapping)) {
-      const filePath = path23.resolve(input.outDir, artifact.path);
-      mkdirSync4(path23.dirname(filePath), { recursive: true });
-      writeFileSync7(filePath, artifact.content);
+      const filePath = path24.resolve(input.outDir, artifact.path);
+      mkdirSync5(path24.dirname(filePath), { recursive: true });
+      writeFileSync8(filePath, artifact.content);
       written.push(filePath);
     }
   }
@@ -10237,7 +10532,7 @@ var GENERATE_DESCRIPTION = {
 function resolveProvidedSource(flags, contextFile) {
   let raw;
   try {
-    raw = readFileSync14(contextFile, "utf8");
+    raw = readFileSync15(contextFile, "utf8");
   } catch {
     fail(flags, ExitCode.InputValidation, {
       error: `Cannot read context file "${contextFile}".`,
@@ -10271,6 +10566,7 @@ function resolveSource(flags, url) {
   });
 }
 async function runGenerate(url, flags) {
+  requireEntitlement(flags);
   if (flags.describe) {
     printDescription(GENERATE_DESCRIPTION);
     return;
@@ -10356,11 +10652,11 @@ token mapping (${mapping.flat.length} variables):
   let initialCode;
   let initialSemantics;
   try {
-    if (existsSync17(flags.out)) {
-      for (const entry of readdirSync3(flags.out)) {
+    if (existsSync18(flags.out)) {
+      for (const entry of readdirSync4(flags.out)) {
         const cjPath = `${flags.out}/${entry}/component.json`;
-        if (!existsSync17(cjPath)) continue;
-        const cj = JSON.parse(readFileSync14(cjPath, "utf8"));
+        if (!existsSync18(cjPath)) continue;
+        const cj = JSON.parse(readFileSync15(cjPath, "utf8"));
         if (cj.name !== void 0 && Array.isArray(cj.props)) {
           previousApi = JSON.stringify({
             componentName: cj.name,
@@ -10368,14 +10664,14 @@ token mapping (${mapping.flat.length} variables):
           });
           const tsxPath = `${flags.out}/${entry}/${cj.name}.tsx`;
           const cssPath = `${flags.out}/${entry}/${cj.name}.css`;
-          if (flags.refine && existsSync17(tsxPath) && existsSync17(cssPath)) {
+          if (flags.refine && existsSync18(tsxPath) && existsSync18(cssPath)) {
             initialCode = {
-              tsx: readFileSync14(tsxPath, "utf8"),
-              css: readFileSync14(cssPath, "utf8")
+              tsx: readFileSync15(tsxPath, "utf8"),
+              css: readFileSync15(cssPath, "utf8")
             };
             const semPath = `${flags.out}/${entry}/semantics.json`;
-            if (existsSync17(semPath)) {
-              initialSemantics = JSON.parse(readFileSync14(semPath, "utf8"));
+            if (existsSync18(semPath)) {
+              initialSemantics = JSON.parse(readFileSync15(semPath, "utf8"));
             }
           }
           break;
@@ -10544,6 +10840,12 @@ function buildProgram() {
     const local = cmd.opts();
     await runDoctor({ ...flags, mcpUrl: local["mcpUrl"] });
   });
+  program.command("activate").description("Activate Tendril on this machine (browser approval; nothing to do on pre-launch builds).").option("--service-url <url>", "override the entitlement service (tests only)").action(async (_o, cmd) => {
+    const flags = globalFlags(cmd);
+    const local = cmd.opts();
+    const { runActivate: runActivate2 } = await Promise.resolve().then(() => (init_activate(), activate_exports));
+    await runActivate2({ ...flags, serviceUrl: local["serviceUrl"] });
+  });
   const record = program.command("record").description("Agent-driven recording protocol: plan the queue, get instructions, ingest verbatim envelopes, resume from disk.");
   record.command("plan").requiredOption("--set <dir>", "recording set directory").requiredOption("--component <name>", "component/system name").requiredOption("--metadata <file...>", "verbatim get_metadata envelope(s), optionally <file>@<frameId>").option("--default <axis=value...>", "explicit axis default, e.g. --default State=Rest (repeatable; persisted to the manifest; may re-plan an unrecorded set)").option("--component-set <name>", "when the metadata holds several component sets, record only this one (name = the set label in the plan error)").option("--sample", "cost sampling: anchor + one-factor + conflict crosses only (the FULL variant matrix is the default; sampling is blind to multi-axis interactions)").action(async (_o, cmd) => {
     const flags = globalFlags(cmd.parent.parent);