@tendrilapp/cli 0.1.18 → 0.1.19

package/dist/SKILL.md

@@ -20,6 +20,28 @@ Non-negotiables (the CLI enforces these; do not fight them):
 - Sub-bar results are honest, not failures to hide: exit 5 ships the
   bundle with real scores. Report them as they are.
 
+First-run friction: if tendril/Figma tool calls are hitting permission
+prompts, tell the user ONE approval can replace them all and offer
+`tendril_permissions` with `write: true` — it merges the pipeline's
+per-tool allowlist into the project's `.claude/settings.local.json`
+(idempotent, touches nothing else; the user reloads the session to
+apply). Never run it unoffered: it edits the user's settings.
+
+Batch runs (several components in one session):
+- Cap concurrent recorders at FOUR. All recorders share one Figma
+  desktop MCP server; a measured 8-wide batch hit its rate limit
+  (per-piece resume recovered, but the stall is avoidable).
+- Batch the questions: plan ALL sets first, then put every
+  defaults-to-confirm and the one model question to the user together
+  — never one dialog per component.
+- Create candidate directories with a bare `mkdir -p <dir>` — no
+  `&&`-compounds. Compound variants each need their own permission
+  approval; the bare form is one grant for the whole batch.
+- Trust only tool output for completion state: check
+  `tendril_record_status` against disk, never a subagent's prose (a
+  measured batch had a recorder report success with zero reps
+  recorded).
+
 ## Recording a new component (needs Figma MCP)
 
 1. Fetch the component set's frame metadata via Figma MCP

package/dist/tendril-mcp.js

@@ -64,6 +64,14 @@ var TOOLS = [
       return argvOut;
     }
   },
+  {
+    name: "tendril_permissions",
+    description: "Install the Claude Code permission allowlist for the Tendril pipeline (write: true \u2014 merges per-tool entries into the project's .claude/settings.local.json, idempotent, never touches other settings), or list the entries without writing. USE THIS when tendril/Figma tool calls keep hitting permission prompts: offer it to the user once \u2014 ONE approval here replaces a prompt per pipeline call (run 8 measured 16+ prompts for a single component's recording). The user must reload the session for new settings to apply.",
+    schema: z.object({
+      write: z.boolean().optional().describe("true = install into .claude/settings.local.json (the point of this tool); false/absent = just return the entries")
+    }),
+    argv: (i) => ["permissions", "--claude", ...i["write"] === true ? ["--write"] : []]
+  },
   {
     name: "tendril_doctor",
     annotations: { readOnlyHint: true },
@@ -259,7 +267,7 @@ var TOOLS = [
   },
   {
     name: "tendril_verify",
-    description: "Verify/check that a component matches its Figma design \u2014 use when the user asks whether an implementation is faithful to the design, or to re-certify an existing Tendril bundle. Recomputes full verification (per-config status, behaviors, composition, evidence artifacts). Free, account-less, network-less \u2014 the trust anchor. Exit 5 means sub-bar with an honest report.",
+    description: "Verify/check that a component matches its Figma design \u2014 use when the user asks whether an implementation is faithful to the design, or to re-certify an existing Tendril bundle. Recomputes full verification (per-config status, behaviors, composition, evidence artifacts). Free, account-less, network-less \u2014 the trust anchor. Exit 5 means below the target bar with an honest report \u2014 sub-bar scores, or at bar cert a config demoted by absent-ink clusters.",
     schema: z.object({
       bundleDir: str("bundle directory to verify"),
       bar: optStr("pass (default) or cert"),
@@ -361,7 +369,7 @@ function toolResult(result) {
   const body = (result.stdout.trim() !== "" ? result.stdout : result.stderr) + stale;
   if (result.exitCode === 5) {
     return { content: [{ type: "text", text: `${body}
-{"exitCode":5,"note":"sub-bar HONEST result \u2014 the report and bundle are valid; this is not a tool failure"}` }] };
+{"exitCode":5,"note":"HONEST below-target result \u2014 the report and bundle are valid; this is not a tool failure. Either sub-bar scores, or (at --bar cert) a config demoted by absent-ink clusters despite at-bar numbers \u2014 the report names which."}` }] };
   }
   const text = result.ok ? body : `${body}
 {"exitCode":${result.exitCode},"note":"CLI exit-code contract: 3 input, 4 confirmation required, 6 fonts unproven, 7 recording incomplete"}`;

package/dist/tendril.js

@@ -762,11 +762,13 @@ function resolveAxisDefaultWithRule(domain, recorded, override) {
     if (off !== void 0) return { value: off, rule: "boolean-off" };
   }
   const avoid = (v) => {
-    const k = kebab(v);
-    return INTERACTION_STATES.has(k) || BOOLEAN_STATES.has(k) || ENGAGED_STATES.has(k);
+    const tokens = kebab(v).split("-");
+    return tokens.some((t) => INTERACTION_STATES.has(t) || BOOLEAN_STATES.has(t) || ENGAGED_STATES.has(t));
   };
   const anyAvoided = recorded.some((v) => avoid(v)) && recorded.some((v) => !avoid(v));
-  const candidates = recorded.some((v) => !avoid(v)) ? recorded.filter((v) => !avoid(v)) : recorded;
+  let candidates = recorded.some((v) => !avoid(v)) ? recorded.filter((v) => !avoid(v)) : recorded;
+  const dotted = candidates.filter((v) => v.split(/\s*-\s*|\s+/).some((part) => part.startsWith(".")));
+  if (dotted.length > 0) candidates = dotted;
   const counts = /* @__PURE__ */ new Map();
   for (const v of candidates) counts.set(v, (counts.get(v) ?? 0) + 1);
   let best;
@@ -789,7 +791,7 @@ var init_axis_defaults = __esm({
     "use strict";
     INTERACTION_STATES = /* @__PURE__ */ new Set(["hover", "focus", "focus-visible", "active", "pressed"]);
     BOOLEAN_STATES = /* @__PURE__ */ new Set(["disabled", "loading"]);
-    ENGAGED_STATES = /* @__PURE__ */ new Set(["selected", "checked", "indeterminate", "open", "expanded"]);
+    ENGAGED_STATES = /* @__PURE__ */ new Set(["selected", "checked", "indeterminate", "mixed", "open", "expanded"]);
     INTERACTION_EVIDENCE_VALUES = /* @__PURE__ */ new Set([
       ...INTERACTION_STATES,
       ...BOOLEAN_STATES,
@@ -1214,8 +1216,8 @@ var init_src = __esm({
 function variableNameToPath(name) {
   return name.split("/").map(canonicalCssIdentPart).filter((part) => part.length > 0);
 }
-function tokenPathToCssVar(path36) {
-  return `--${path36.join("-")}`;
+function tokenPathToCssVar(path38) {
+  return `--${path38.join("-")}`;
 }
 function toDtcgToken(variable, defaultMode) {
   const modes = Object.keys(variable.valuesByMode);
@@ -1259,11 +1261,11 @@ function toDtcgToken(variable, defaultMode) {
 }
 function mapVariablesToDtcg(variables, defaultMode = "light") {
   const entries = variables.map((variable) => {
-    const path36 = variableNameToPath(variable.name);
-    if (path36.length === 0) {
+    const path38 = variableNameToPath(variable.name);
+    if (path38.length === 0) {
       throw new DtcgMappingError("empty-name", `Figma variable ${variable.id} has an empty name`);
     }
-    return { variable, path: path36 };
+    return { variable, path: path38 };
   });
   const groupPrefixes = /* @__PURE__ */ new Set();
   for (const e of entries) {
@@ -1284,21 +1286,21 @@ function mapVariablesToDtcg(variables, defaultMode = "light") {
   }
   const tokens = {};
   const flat = [];
-  for (const { variable, path: path36 } of entries) {
+  for (const { variable, path: path38 } of entries) {
     const token = toDtcgToken(variable, defaultMode);
     let group = tokens;
-    for (const segment of path36.slice(0, -1)) {
+    for (const segment of path38.slice(0, -1)) {
       const existing = group[segment];
       group = existing ?? (group[segment] = {});
     }
-    const leaf = path36[path36.length - 1];
+    const leaf = path38[path38.length - 1];
     if (group[leaf] !== void 0) {
-      throw new DtcgMappingError("duplicate-path", `Duplicate token path "${path36.join(".")}" (variable ${variable.id})`);
+      throw new DtcgMappingError("duplicate-path", `Duplicate token path "${path38.join(".")}" (variable ${variable.id})`);
     }
     group[leaf] = token;
     flat.push({
-      path: path36.join("."),
-      cssVar: tokenPathToCssVar(path36),
+      path: path38.join("."),
+      cssVar: tokenPathToCssVar(path38),
       type: token.$type,
       value: token.$value
     });
@@ -1487,9 +1489,9 @@ function boundId(value) {
   return isObject(value) && typeof value["boundVariableId"] === "string" ? value["boundVariableId"] : void 0;
 }
 function resolveBinding(ctx, id) {
-  const path36 = ctx.pathById.get(id);
-  if (path36 === void 0) ctx.unresolved.add(id);
-  return path36;
+  const path38 = ctx.pathById.get(id);
+  if (path38 === void 0) ctx.unresolved.add(id);
+  return path38;
 }
 function parseVariantProps(name) {
   if (!name.includes("=")) return void 0;
@@ -1524,8 +1526,8 @@ function walk(ctx, raw) {
       if (!isObject(paint) || paint["visible"] === false) continue;
       const id = boundId(paint);
       if (id !== void 0) {
-        const path36 = resolveBinding(ctx, id);
-        if (path36 !== void 0) tokens.add(path36);
+        const path38 = resolveBinding(ctx, id);
+        if (path38 !== void 0) tokens.add(path38);
       } else if (typeof paint["color"] === "string") {
         ctx.hardcoded.push({ node: name, property, value: paint["color"] });
       }
@@ -1533,8 +1535,8 @@ function walk(ctx, raw) {
   }
   const radiusId = boundId(raw["cornerRadius"]);
   if (radiusId !== void 0) {
-    const path36 = resolveBinding(ctx, radiusId);
-    if (path36 !== void 0) tokens.add(path36);
+    const path38 = resolveBinding(ctx, radiusId);
+    if (path38 !== void 0) tokens.add(path38);
   } else if (typeof raw["cornerRadius"] === "number" && raw["cornerRadius"] !== 0) {
     ctx.hardcoded.push({ node: name, property: "border-radius", value: `${raw["cornerRadius"]}px` });
   }
@@ -1544,10 +1546,10 @@ function walk(ctx, raw) {
     layout = { mode: layoutMode === "HORIZONTAL" ? "flex-row" : "flex-column" };
     const gapId = boundId(raw["itemSpacing"]);
     if (gapId !== void 0) {
-      const path36 = resolveBinding(ctx, gapId);
-      if (path36 !== void 0) {
-        layout.gap = path36;
-        tokens.add(path36);
+      const path38 = resolveBinding(ctx, gapId);
+      if (path38 !== void 0) {
+        layout.gap = path38;
+        tokens.add(path38);
       }
     } else if (typeof raw["itemSpacing"] === "number" && raw["itemSpacing"] !== 0) {
       ctx.hardcoded.push({ node: name, property: "gap", value: `${raw["itemSpacing"]}px` });
@@ -1556,10 +1558,10 @@ function walk(ctx, raw) {
     for (const field of PADDING_FIELDS) {
       const id = boundId(raw[field]);
       if (id !== void 0) {
-        const path36 = resolveBinding(ctx, id);
-        if (path36 !== void 0) {
-          paddingPaths.push(path36);
-          tokens.add(path36);
+        const path38 = resolveBinding(ctx, id);
+        if (path38 !== void 0) {
+          paddingPaths.push(path38);
+          tokens.add(path38);
         }
       } else if (typeof raw[field] === "number" && raw[field] !== 0) {
         ctx.hardcoded.push({ node: name, property: field, value: `${raw[field]}px` });
@@ -4378,14 +4380,17 @@ function chooseSeat(cropAt, ref, padW, padH, backdrop, origin, extents) {
   }
   return { comparison, seat, scored: cropAt(origin - seat.x, origin - seat.y) };
 }
-function deepestNodeNameAt(set, rep, px, py) {
-  let root;
+function metadataRoot(set, rep) {
   try {
     const text = JSON.parse(readFileSync8(path15.join(set, rep, "get_metadata.json"), "utf8")).content.map((c) => c.text ?? "").join("\n");
-    root = parseMetadataStructure(text);
+    return parseMetadataStructure(text);
   } catch {
     return void 0;
   }
+}
+function deepestNodeNameAt(set, rep, px, py) {
+  const root = metadataRoot(set, rep);
+  if (root === void 0) return void 0;
   let best;
   const walk2 = (node, ox, oy, isRoot) => {
     if (node.hidden === true) return;
@@ -4401,7 +4406,35 @@ function deepestNodeNameAt(set, rep, px, py) {
     for (const child of node.children) walk2(child, nx, ny, false);
   };
   walk2(root, 0, 0, true);
-  return best?.name;
+  if (best !== void 0) return best.name;
+  if (root.name !== "" && px >= 0 && py >= 0 && px < (root.width ?? 0) && py < (root.height ?? 0)) {
+    return `${root.name} (${root.id}) (edge region, no named child at this point)`;
+  }
+  return void 0;
+}
+function smallSemanticNodes(set, rep, maxArea = 1024) {
+  const root = metadataRoot(set, rep);
+  if (root === void 0) return [];
+  const found = [];
+  const walk2 = (node, ox, oy, isRoot) => {
+    if (node.hidden === true) return;
+    const nx = isRoot ? 0 : ox + (node.x ?? 0);
+    const ny = isRoot ? 0 : oy + (node.y ?? 0);
+    const w = node.width ?? 0;
+    const h = node.height ?? 0;
+    if (!isRoot && node.name !== "" && w >= 2 && h >= 2 && w * h <= maxArea) {
+      found.push({ name: node.name, id: node.id, x: nx, y: ny, w, h });
+    }
+    for (const child of node.children) walk2(child, nx, ny, false);
+  };
+  walk2(root, 0, 0, true);
+  const seen = /* @__PURE__ */ new Set();
+  return found.sort((a, b) => a.w * a.h - b.w * b.h).filter((n) => {
+    const key = `${n.x}:${n.y}:${n.w}:${n.h}`;
+    if (seen.has(key)) return false;
+    seen.add(key);
+    return true;
+  });
 }
 function repMeta(set, rep) {
   const text = JSON.parse(readFileSync8(path15.join(set, rep, "get_metadata.json"), "utf8")).content.map((c) => c.text ?? "").join("\n");
@@ -6810,7 +6843,13 @@ var init_bundle = __esm({
         // insufficient identity (two builds, one path, incomparable
         // numbers); optional so pre-epoch bundles keep validating.
         chromeVersion: z10.string().nullable().optional(),
-        fontsManifestSha256: z10.string().nullable()
+        fontsManifestSha256: z10.string().nullable(),
+        // Run 11: a bundle scored under a substitute face carried CSS
+        // compensation (font-variation-settings tuned to the substitute)
+        // with nothing marking it conditional — the provenance now names
+        // the families that were substituted at scoring time. Optional so
+        // pre-0.1.19 bundles keep validating; absent means none.
+        substitutedFamilies: z10.array(z10.string()).optional()
       }),
       /** Coverage denominator (Q2 honesty): recorded vs full-lattice size
        * when the lattice is known (null when the kit exposes no lattice). */
@@ -7746,6 +7785,9 @@ function buildFeedback(scores, behaviors, bar, mode = "fenced") {
     const reg = s.region !== void 0 ? ` worst-region=[x ${s.region.x0}-${s.region.x1}, y ${s.region.y0}-${s.region.y1}, density ${s.region.density}]` : "";
     return base + err + reg;
   });
+  const absentLines = scores.flatMap(
+    (s) => (s.absentInk ?? []).map((c) => `MISSING ${s.rep}: ${c.name ?? "unnamed region"} \u2014 ${c.px}px of recorded ink with NO render ink within reach at [x ${c.x}-${c.x + c.w}, y ${c.y}-${c.y + c.h}]`)
+  );
   return `Scores (bar: sim \u2265${bar.sim} AND ink \u2265${bar.ink} per config):
 ${lines.join("\n")}${behLines.length > 0 ? `
 
@@ -7753,9 +7795,12 @@ BEHAVIORAL invariants (machine-verified, GATING \u2014 fix these with real handl
 ${behLines.join("\n")}` : ""}${preludeLines.length > 0 ? `
 
 PRELUDE parity (computed-style checks, GATING \u2014 fix the named CSS property on the named element):
-${preludeLines.join("\n")}` : ""}
+${preludeLines.join("\n")}` : ""}${absentLines.length > 0 ? `
 
-Fix the FAIL configs (region coordinates are in the recorded screenshot's frame; ink<1 means recorded foreground pixels your render does not cover). Do not regress PASS configs. ${mode === "files" ? "Update the files in your candidate directory and re-run the score." : "Reply with the complete corrected files in the same FILE format."}`;
+MISSING FEATURES (absent-ink clusters \u2014 recorded marks your render leaves out or paints invisibly; GATING at the cert bar. Fix the named node's ink \u2014 a config carrying one cannot certify):
+${absentLines.join("\n")}` : ""}
+
+Fix the FAIL configs (region coordinates are in the recorded screenshot's frame; ink<1 means recorded foreground pixels your render does not cover). Reading the pair: ink=1 with LOW sim means nothing is missing \u2014 shapes or positions are wrong, do not chase missing ink; LOW ink with high sim means recorded marks are absent or painted invisibly. Do not regress PASS configs. ${mode === "files" ? "Update the files in your candidate directory and re-run the score." : "Reply with the complete corrected files in the same FILE format."}`;
 }
 function archivePriorRun(outDir) {
   if (!existsSync20(path26.join(outDir, "run-log.json")) && !existsSync20(path26.join(outDir, "loop-state.json"))) return void 0;
@@ -7825,14 +7870,14 @@ async function runEngineLoop(opts) {
     progress(
       `iter ${iter}: pass=${obj[0]}/${total} floor=${obj[1].toFixed(3)} mean=${obj[2].toFixed(3)} ${accepted ? "ACCEPT" : "reject"} $${usd.toFixed(3)} (total $${spentUsd.toFixed(3)})${modelMs !== void 0 ? ` model=${Math.round(modelMs / 1e3)}s` : ""} score=${Math.round(scoreMs / 1e3)}s`
     );
-    return { allPass: obj[0] === total && total > 0 };
+    return { allPass: obj[0] === total && total > 0 && (opts.absentInkGates !== true || scores.every((s) => (s.absentInk?.length ?? 0) === 0)) };
   };
   if (opts.seed !== void 0 && !resuming) {
     const { allPass } = await scoreCandidate(opts.seed, 0, 0);
     if (allPass) stopReason = "all-pass";
   }
   const lastLog = log[log.length - 1];
-  if (resuming && lastLog !== void 0 && lastLog.parseError === void 0 && lastLog.scores.length > 0 && lastLog.objective[0] === lastLog.scores.length + (lastLog.behaviors?.length ?? 0)) {
+  if (resuming && lastLog !== void 0 && lastLog.parseError === void 0 && lastLog.scores.length > 0 && lastLog.objective[0] === lastLog.scores.length + (lastLog.behaviors?.length ?? 0) && (opts.absentInkGates !== true || lastLog.scores.every((s) => (s.absentInk?.length ?? 0) === 0))) {
     stopReason = "all-pass";
   }
   const state = () => ({
@@ -8257,6 +8302,23 @@ function recordedFontNeeds(setDir) {
     return { family, weights: weights.size === 0 ? [400] : [...weights].sort((a, b) => a - b) };
   });
 }
+function symbolFontGlyphCount(setDir, reps) {
+  const PUA = /[\uE000-\uF8FF\u{F0000}-\u{FFFFD}\u{100000}-\u{10FFFD}]/u;
+  const glyphs = /* @__PURE__ */ new Set();
+  for (const rep of reps) {
+    const file = path27.join(setDir, rep, "get_metadata.json");
+    if (!existsSync21(file)) continue;
+    try {
+      const text = JSON.parse(readFileSync18(file, "utf8")).content.map((c) => c.text ?? "").join("\n");
+      for (const m of text.matchAll(/<text\s[^>]*name="([^"]*)"/g)) {
+        const name = decodeXmlEntities(m[1]).replace(/&#x([0-9a-fA-F]+);/g, (_, h) => String.fromCodePoint(parseInt(h, 16))).replace(/&#(\d+);/g, (_, d) => String.fromCodePoint(Number(d)));
+        if (PUA.test(name)) glyphs.add(name);
+      }
+    } catch {
+    }
+  }
+  return glyphs.size;
+}
 function recordedFontFamilies(setDir) {
   return recordedFontNeeds(setDir).map((n) => n.family);
 }
@@ -8453,6 +8515,12 @@ function authorTaskFromSet(setDir, opts = {}) {
     return void 0;
   }).filter((x) => x !== void 0);
   const { behaviors, prelude, disclosures } = authorBehaviors(api, { ...sentinels.length > 0 ? { sentinels } : {} });
+  const puaGlyphs = symbolFontGlyphCount(setDir, manifest.reps.map((r) => r.slug));
+  if (puaGlyphs > 0) {
+    disclosures.push(
+      `SYMBOL-FONT ICONS: ${puaGlyphs} distinct recorded icon glyph(s) come from a symbol font (private-use codepoints) \u2014 the recording carries NO vector geometry for them. Reconstruct each mark against the reference pixels with extreme care, compare magnified crops after every score (run 11 shipped a checkmark where the reference was a dot, and a diamond where it was two chevrons \u2014 both scored above bar), and NEVER give two configs sharing the same recorded glyph different shapes`
+    );
+  }
   if (dismissName !== void 0) {
     disclosures.push(`dismiss affordance detected from the recording (${dismissName}) \u2014 onDismiss authored; dismiss-notifies-and-commits enforces the notification contract`);
   }
@@ -8825,12 +8893,17 @@ function cssFontFamilies(css) {
   }
   return [...out];
 }
-function fontsCssFor(faces, bundleDir, cacheDir = DEFAULT_FONT_CACHE) {
+function fontsCssFor(faces, bundleDir, cacheDir = DEFAULT_FONT_CACHE, substitutedFamilies = []) {
   const header = [
     "/* tendril fonts.css \u2014 the exact faces this bundle was scored with (sha-pinned in",
     "   component.json requiredFonts). Load it alongside styles.css so the component",
     "   renders in the recorded typeface \u2014 without it the browser substitutes, which is",
-    "   exactly the drift verification exists to rule out. Not read by scoring. */"
+    "   exactly the drift verification exists to rule out. Not read by scoring. */",
+    ...substitutedFamilies.length > 0 ? [
+      `/* GENERATED UNDER FONT SUBSTITUTION: ${substitutedFamilies.map((f) => `'${f}'`).join(", ")} was/were NOT provisioned \u2014`,
+      "   scores measured a substitute face and no config certified. This file covers only",
+      "   cache-provided faces; resolve the real families and re-score for the full set. */"
+    ] : []
   ];
   const lines = [];
   for (const face of faces) {
@@ -8903,7 +8976,8 @@ function recordingSetHash(setDir, configs) {
   );
 }
 function statusOf(s) {
-  return tierOf(s, BARS.cert);
+  const tier = tierOf(s, BARS.cert);
+  return tier === "certified" && (s.absentInk?.length ?? 0) > 0 ? "pass" : tier;
 }
 function emitBundleV1(opts) {
   const substituted = (opts.substitutedFamilies ?? []).length > 0;
@@ -8953,7 +9027,7 @@ function emitBundleV1(opts) {
         ...opts.licenseNote !== void 0 ? { licenseNote: opts.licenseNote } : {},
         hash: recordingSetHash(opts.task.set, opts.task.configs)
       },
-      environment: opts.environment,
+      environment: { ...opts.environment, ...(opts.substitutedFamilies ?? []).length > 0 ? { substitutedFamilies: opts.substitutedFamilies } : {} },
       coverage: { recordedConfigs: statuses.length, latticeConfigs: lattice },
       generatedAt: opts.generatedAt ?? (/* @__PURE__ */ new Date()).toISOString(),
       ...opts.spentUsd !== void 0 ? { spentUsd: opts.spentUsd } : {}
@@ -8986,7 +9060,7 @@ ${stripped}`);
   const fontsCssPath = path29.join(opts.bundleDir, "fonts.css");
   rmSync3(path29.join(opts.bundleDir, "fonts"), { recursive: true, force: true });
   rmSync3(fontsCssPath, { force: true });
-  const fontsCss = fontsCssFor(requiredFontsManifest(families, opts.fontCacheDir), opts.bundleDir, opts.fontCacheDir);
+  const fontsCss = fontsCssFor(requiredFontsManifest(families, opts.fontCacheDir), opts.bundleDir, opts.fontCacheDir, opts.substitutedFamilies ?? []);
   if (fontsCss !== null) {
     writeFileSync11(fontsCssPath, fontsCss);
     written.push(fontsCssPath);
@@ -9187,6 +9261,22 @@ function unprovisionedFamilies(setDir, cacheDir) {
   const provided = new Set(verifiedFontFamilies(cacheDir).map((f) => f.family.toLowerCase()));
   return declared.filter((f) => !provided.has(f.toLowerCase()));
 }
+function missingWeights(setDir, cacheDir) {
+  let needs;
+  try {
+    needs = recordedFontNeeds(setDir);
+  } catch {
+    return [];
+  }
+  const provided = new Map(verifiedFontFamilies(cacheDir).map((f) => [f.family.toLowerCase(), f.weights]));
+  const gaps = [];
+  for (const n of needs) {
+    const have = provided.get(n.family.toLowerCase());
+    if (have === void 0) continue;
+    if (n.weights.some((w) => !have.includes(w))) gaps.push({ family: n.family, declared: n.weights, provided: have });
+  }
+  return gaps;
+}
 var init_font_guidance = __esm({
   "packages/cli/src/font-guidance.ts"() {
     "use strict";
@@ -9198,6 +9288,7 @@ var init_font_guidance = __esm({
 // packages/cli/src/commands/verify.ts
 var verify_exports = {};
 __export(verify_exports, {
+  foldConfigStatus: () => foldConfigStatus,
   interactionCoverage: () => interactionCoverage,
   runVerify: () => runVerify
 });
@@ -9212,6 +9303,26 @@ function interactionCoverage(behaviors) {
     operability: interaction.length > 0 && interaction.every((b) => b.pass) ? "verified" : "unverified"
   };
 }
+function foldConfigStatus(s, failDemotions, substitutedFamilies) {
+  const { exact: _exact, ...reported } = s;
+  let status = tierOf(s, BARS2.cert);
+  const certDemote = [];
+  let absentInkDemoted = false;
+  if (status === "certified" && s.absentInk !== void 0 && s.absentInk.length > 0) {
+    status = "pass";
+    absentInkDemoted = true;
+    certDemote.push(...s.absentInk.map((c) => `absent ink: ${c.name ?? "unnamed region"} \u2014 ${c.px}px of recorded ink with no render ink within reach (missing or invisible feature)`));
+  }
+  if (status === "certified" && substitutedFamilies.length > 0) {
+    status = "pass";
+    certDemote.push(`substituted fonts: cache lacks ${substitutedFamilies.map((f) => `"${f}"`).join(", ")} \u2014 certification never measures a substitute face`);
+  }
+  const base = certDemote.length > 0 ? { ...reported, status, demotedBy: certDemote } : { ...reported, status };
+  return {
+    row: failDemotions === void 0 ? base : { ...base, status: "fail", demotedBy: [...certDemote, ...failDemotions] },
+    absentInkDemoted
+  };
+}
 function taskFromManifest(opts, manifest, setDir) {
   const recordedSlugs = loadManifest(setDir).reps.map((r) => r.slug);
   const adapterSlugs = Object.keys(manifest.propAdapter);
@@ -9357,6 +9468,9 @@ async function runVerify(opts) {
   } else if (opts.bar === "cert" && taskFontFamilies(task.set) === null) {
     warn(opts, "family coverage could not be established from this recording (no declared families) \u2014 the certification gate covers only cache non-emptiness here");
   }
+  for (const g of missingWeights(task.set)) {
+    warn(opts, `font weights (advisory): the recording implies weights ${g.declared.join(", ")} for "${g.family}" \u2014 cache provides ${g.provided.join(", ")}; nearest-weight rendering may shift stroke density (certification stays family-gated; implied weights can leak across families)`);
+  }
   const missing = task.configs.filter(
     (c) => !existsSync25(path31.join(task.set, c.rep, "get_screenshot.json")) || !existsSync25(path31.join(task.set, c.rep, "get_metadata.json"))
   );
@@ -9387,23 +9501,10 @@ async function runVerify(opts) {
   if (crops !== void 0) {
     for (const c of crops) if (!c.pass) demote(c.id.split(":")[1] ?? "", "composition crop failed (A1.4)");
   }
+  const folded = scores.map((s) => foldConfigStatus(s, demotions.get(s.rep), substitutedFamilies));
+  const absentInkDemoted = scores.filter((_, i) => folded[i].absentInkDemoted).map((s) => s.rep);
   const statuses = [
-    ...scores.map((s) => {
-      const { exact: _exact, ...reported } = s;
-      let status = tierOf(s, BARS2.cert);
-      const certDemote = [];
-      if (status === "certified" && s.absentInk !== void 0 && s.absentInk.length > 0) {
-        status = "pass";
-        certDemote.push(...s.absentInk.map((c) => `absent ink: ${c.name ?? "unnamed region"} \u2014 ${c.px}px of recorded ink with no render ink within reach (missing or invisible feature)`));
-      }
-      if (status === "certified" && substitutedFamilies.length > 0) {
-        status = "pass";
-        certDemote.push(`substituted fonts: cache lacks ${substitutedFamilies.map((f) => `"${f}"`).join(", ")} \u2014 certification never measures a substitute face`);
-      }
-      const base = certDemote.length > 0 ? { ...reported, status, demotedBy: certDemote } : { ...reported, status };
-      const reasons = demotions.get(s.rep);
-      return reasons === void 0 ? base : { ...base, status: "fail", demotedBy: [...certDemote.length > 0 ? certDemote : [], ...reasons] };
-    }),
+    ...folded.map((f) => f.row),
     // ADR-010 §2 anti-gaming: recorded configs the adapter does not map
     // are FAILs, never silently absent.
     ...unmapped.map((rep) => ({ rep, similarity: 0, inkRecall: 0, pass: false, status: "fail", error: "not mapped by the bundle's prop adapter" }))
@@ -9416,7 +9517,9 @@ async function runVerify(opts) {
   const occlusionFailures = occlusion.filter((o) => !o.pass);
   const coverage = interactionCoverage(behaviors);
   const evidenceUnverified = interactionEvidence.length > 0 && coverage.interactionChecks === 0;
-  const ok = pixelFailures.length === 0 && behaviorFailures.length === 0 && structuralFailures.length === 0 && cropFailures.length === 0 && occlusionFailures.length === 0 && !evidenceUnverified;
+  const okExceptDemotion = pixelFailures.length === 0 && behaviorFailures.length === 0 && structuralFailures.length === 0 && cropFailures.length === 0 && occlusionFailures.length === 0 && !evidenceUnverified;
+  const certBlockedByAbsentInk = opts.bar === "cert" ? absentInkDemoted : [];
+  const ok = okExceptDemotion && certBlockedByAbsentInk.length === 0;
   const report = {
     bundle: opts.bundleDir,
     ...opts.task !== void 0 ? { task: opts.task } : {},
@@ -9473,7 +9576,11 @@ async function runVerify(opts) {
         crops: crops ?? { unavailable: regionsOut !== void 0 && "unavailable" in regionsOut ? regionsOut.unavailable : "no role manifest" }
       }
     } : {},
-    verdict: ok ? "verified" : "verification-failed"
+    verdict: ok ? "verified" : "verification-failed",
+    // Machine-readable cause (adversarial review): a cert-bar failure
+    // with zero pixel/behavior/composition failures was only
+    // explainable from stderr prose.
+    ...certBlockedByAbsentInk.length > 0 ? { certBlockedByAbsentInk } : {}
   };
   emitData(opts, report, () => {
     for (const s of statuses) {
@@ -9533,7 +9640,7 @@ ${certified}/${statuses.length} certified \xB7 ${report.coverage.pass}/${statuse
     }
     if (evidenceUnverified) {
       process.stdout.write(
-        `FAIL      interaction-evidence \u2014 the recording proves interactive poses (${interactionEvidence.join(", ")}) and ZERO interaction behaviors were verified. The authoring vocabulary did not map them; this is an instrument failure, not a verified component.
+        `FAIL      interaction-evidence \u2014 the recording proves interactive poses (${interactionEvidence.join(", ")}) and ZERO interaction behaviors were verified. The authoring vocabulary did not map them; this is an instrument failure, not a verified component. Mappable today: ${[...INTERACTION_STATES, ...BOOLEAN_STATES].join("/")} \u2014 on an axis named State (checked/selected state axes are recorded as evidence but not yet authorable \u2014 widening is on the roadmap; this is not fixable from component code).
 `
       );
     } else if (ic.interactionChecks === 0) {
@@ -9572,21 +9679,29 @@ ${certified}/${statuses.length} certified \xB7 ${report.coverage.pass}/${statuse
   });
   if (opts.bar === "cert" && substitutedFamilies.length > 0) {
     const names = substitutedFamilies.map((f) => `"${f}"`).join(", ");
+    const alsoAbsent = absentInkDemoted.length > 0 ? ` \u2014 and ${absentInkDemoted.length} config(s) also carry absent-ink demotions (named in the report); certification requires fixing those too` : "";
     if (opts.json) {
-      process.stderr.write(`${JSON.stringify({ error: `font cache lacks ${names} \u2014 certification never measures a substitute face (scores above are pass-capped)`, code: "fonts-unproven", remediation: fontsUnprovenRemediation(task.set) })}
+      process.stderr.write(`${JSON.stringify({ error: `font cache lacks ${names} \u2014 certification never measures a substitute face (scores above are pass-capped)${alsoAbsent}`, code: "fonts-unproven", remediation: fontsUnprovenRemediation(task.set) })}
 `);
     } else {
-      process.stderr.write(`error (fonts-unproven): font cache lacks ${names} \u2014 certification never measures a substitute face (scores above are pass-capped)
+      process.stderr.write(`error (fonts-unproven): font cache lacks ${names} \u2014 certification never measures a substitute face (scores above are pass-capped)${alsoAbsent}
   \u2192 ${fontsUnprovenRemediation(task.set)}
 `);
     }
     process.exitCode = ExitCode.FontsUnproven;
     return;
   }
-  if (!ok) {
+  if (certBlockedByAbsentInk.length > 0) {
     warn(
       opts,
-      `${pixelFailures.length} config(s), ${behaviorFailures.length} behavior(s), ${structuralFailures.length + cropFailures.length + occlusionFailures.length} composition check(s) below the ${opts.bar} bar \u2014 bundle written, verdict honest (Q4)`
+      `${certBlockedByAbsentInk.length} config(s) demoted by absent-ink clusters (${certBlockedByAbsentInk.join(", ")}) \u2014 certification never ships a missing or invisible feature; each cluster is named in the report above. Fix the component and re-verify, or verify at --bar pass for the disclosed result.`
+    );
+    process.exitCode = ExitCode.VerificationFailed;
+  }
+  if (!okExceptDemotion) {
+    warn(
+      opts,
+      `${pixelFailures.length} config(s), ${behaviorFailures.length} behavior(s), ${structuralFailures.length + cropFailures.length + occlusionFailures.length} composition check(s) below the ${opts.bar} bar${evidenceUnverified ? "; PLUS the interaction-evidence instrument gate failed (operability could not be verified \u2014 see FAIL interaction-evidence above)" : ""} \u2014 bundle written, verdict honest (Q4)`
     );
     process.exitCode = ExitCode.VerificationFailed;
   }
@@ -9616,18 +9731,18 @@ __export(engine_exports, {
   runEngineBrief: () => runEngineBrief,
   runEngineScore: () => runEngineScore
 });
-import { existsSync as existsSync26, mkdirSync as mkdirSync8, readFileSync as readFileSync23, writeFileSync as writeFileSync12 } from "node:fs";
+import { appendFileSync, existsSync as existsSync26, mkdirSync as mkdirSync8, readFileSync as readFileSync23, writeFileSync as writeFileSync12 } from "node:fs";
 import path32 from "node:path";
 function resolveEngineTask(opts, callerCwd) {
   const asPath = path32.resolve(callerCwd, opts.taskOrSet);
   const isSet = existsSync26(path32.join(asPath, "recording-set.json"));
   const registry = TASKS[opts.taskOrSet];
-  if (registry !== void 0 && !isSet) return { task: registry, name: opts.taskOrSet, disclosures: [] };
+  if (registry !== void 0 && !isSet) return { task: registry, name: opts.taskOrSet, disclosures: [], interactionEvidence: [] };
   if (isSet) {
     try {
       const authored = authorTaskFromSet(asPath);
       for (const d of authored.disclosures) warn(opts, d);
-      return { task: authored.task, name: path32.basename(asPath), disclosures: authored.disclosures, apiPin: { props: authored.api.apiPin.props, forcedStates: authored.api.apiPin.forcedStates } };
+      return { task: authored.task, name: path32.basename(asPath), disclosures: authored.disclosures, interactionEvidence: authored.api.interactionEvidence, apiPin: { props: authored.api.apiPin.props, forcedStates: authored.api.apiPin.forcedStates } };
     } catch (err) {
       fail(opts, ExitCode.InputValidation, {
         error: `cannot author a task from ${asPath}: ${err instanceof Error ? err.message.split("\n")[0] : String(err)}`,
@@ -9669,12 +9784,14 @@ ${notRecorded}` : "";
     const unprovided = recordedFontFamilies(task.set).filter((r) => !provided.some((p) => p.toLowerCase() === r.toLowerCase()));
     if (unprovided.length > 0) {
       const names = unprovided.map((f) => `'${f}'`).join(", ");
+      const PROPRIETARY = /^(sf pro|sf compact|sf mono|new york|pingfang|segoe ui|helvetica neue|proxima nova|avenir)/i;
+      const allProprietary = unprovided.every((f) => PROPRIETARY.test(f.trim()));
       fontProvisioning = {
         unprovided,
         question: {
           prompt: `This design's text uses ${names}, which is not in the local font kit. How should it be handled?`,
           options: [
-            `(Recommended) Run \`tendril fonts resolve --set ${task.set}\` \u2014 open-source families are fetched automatically. Any face that fails there is one you license privately: run \`tendril fonts add "<Family>" <weight> <file>\` with the .woff2/.ttf/.otf you hold (the file never leaves this machine). Then re-run this brief \u2014 exact text fidelity.`,
+            allProprietary ? `(Recommended) ${names} ${unprovided.length === 1 ? "is a proprietary face" : "are proprietary faces"} \u2014 Google Fonts cannot serve ${unprovided.length === 1 ? "it" : "them"}, so skip \`fonts resolve\`: run \`tendril fonts add "<Family>" <weight> <file>\` with the .woff2/.ttf/.otf you hold a licence for (the file never leaves this machine), then re-run this brief \u2014 exact text fidelity.` : `(Recommended) Run \`tendril fonts resolve --set ${task.set}\` \u2014 open-source families are fetched automatically. Any face that fails there is one you license privately: run \`tendril fonts add "<Family>" <weight> <file>\` with the .woff2/.ttf/.otf you hold (the file never leaves this machine). Then re-run this brief \u2014 exact text fidelity.`,
             'Continue with a substitute face: generation proceeds in a provided family, no config can score "certified" under it (cert-bar runs exit fonts-unproven after their report), the substitution is disclosed, and small text differences are expected and not fixable from CSS.'
           ]
         },
@@ -9733,7 +9850,7 @@ async function runEngineScore(opts) {
   requireEntitlement(opts);
   const callerCwd = process.env["INIT_CWD"] ?? process.cwd();
   const candidateDir = path32.resolve(callerCwd, opts.candidateDir);
-  const { task, name, apiPin } = resolveEngineTask(opts, callerCwd);
+  const { task, name, apiPin, interactionEvidence } = resolveEngineTask(opts, callerCwd);
   if (!existsSync26(candidateDir)) {
     fail(opts, ExitCode.InputValidation, {
       error: `candidate directory not found: ${candidateDir}`,
@@ -9752,6 +9869,9 @@ async function runEngineScore(opts) {
   if (substitutedFamilies.length > 0) {
     warn(opts, `substituted fonts: cache lacks ${substitutedFamilies.map((f) => `"${f}"`).join(", ")} \u2014 scores measure a substitute face and no config can be certified under one (the stamp covers only the provisioned subset); resolve the families to certify`);
   }
+  for (const g of missingWeights(task.set)) {
+    warn(opts, `font weights (advisory): the recording implies weights ${g.declared.join(", ")} for "${g.family}" \u2014 cache provides ${g.provided.join(", ")}; nearest-weight rendering may shift stroke density (certification stays family-gated; implied weights can leak across families)`);
+  }
   if (opts.rebind !== true && existsSync26(path32.join(candidateDir, "component.json"))) {
     const prior = (() => {
       try {
@@ -9792,12 +9912,13 @@ ${[
     ...quality.findings.map((f) => `- ${f.kind} ${f.file}${f.line === void 0 ? "" : `:${f.line}`} \u2014 ${f.message}`),
     ...quality.tokensAbsent ? ["- no design tokens: no tokens.css and no var(--\u2026) reference; every value is hardcoded"] : []
   ].join("\n")}`;
-  const allPass = obj[0] === total && total > 0;
+  const absentAtCertBar = opts.bar === "cert" ? scores.filter((sc) => (sc.absentInk?.length ?? 0) > 0).map((sc) => sc.rep) : [];
+  const allPass = obj[0] === total && total > 0 && absentAtCertBar.length === 0;
   const certBar = BARS3["cert"];
   const parityDemoted = new Set(parity.filter((p) => !p.pass).map((p) => p.id.replace(/^parity:/, "")));
   const certifiedReps = substitutedFamilies.length > 0 ? [] : scores.filter((sc) => tierOf(sc, certBar) === "certified" && !parityDemoted.has(sc.rep) && (sc.absentInk === void 0 || sc.absentInk.length === 0)).map((sc) => sc.rep);
   const certifiedSet = new Set(certifiedReps);
-  const absentFindings = scores.flatMap((sc) => (sc.absentInk ?? []).map((c) => `- ${sc.rep}: ${c.name ?? "unnamed region"} \u2014 ${c.px}px of recorded ink with NO render ink within reach at [x ${c.x}-${c.x + c.w}, y ${c.y}-${c.y + c.h}] (missing or invisible feature; magnified crops in the evidence dir; coordinates are reference-space \u2014 subtract the config's seat for box-space). A certified-tier config with such a finding is demoted to pass.`));
+  const absentFindings = scores.flatMap((sc) => (sc.absentInk ?? []).map((c) => `- ${sc.rep}: ${c.name ?? "unnamed region"} \u2014 ${c.px}px of recorded ink with NO render ink within reach at [x ${c.x}-${c.x + c.w}, y ${c.y}-${c.y + c.h}] (missing or invisible feature; magnified crops in the evidence dir; coordinates are reference-space \u2014 subtract the config's seat for box-space). A certified-tier config with such a finding is demoted to pass, and at --bar cert it FAILS the run (exit 5).`));
   const absentBlock = absentFindings.length > 0 ? `
 
 MISSING FEATURES (absent-ink clusters \u2014 recorded ink your render leaves nowhere near covered; fix these first, the global numbers cannot see them):
@@ -9819,6 +9940,11 @@ METRIC DEADBAND (read before iterating on near-misses): the scored similarity/in
     environment: environmentStamp(taskFontFamilies(task.set)),
     substitutedFamilies
   });
+  appendFileSync(
+    path32.join(candidateDir, "score-history.jsonl"),
+    `${JSON.stringify({ at: (/* @__PURE__ */ new Date()).toISOString(), bar: opts.bar, pass: obj[0], total, certified: certifiedReps.length, floor: obj[1], mean: obj[2] })}
+`
+  );
   emitData(
     opts,
     {
@@ -9838,6 +9964,10 @@ METRIC DEADBAND (read before iterating on near-misses): the scored similarity/in
       bundleManifest: emitted.written[0],
       note: "styles.css was stamped with the bundle provenance comment on line 1 \u2014 preserve it in any post-score edit",
       allPass,
+      // Run 11: generators read allPass:true and reported success on
+      // bundles verify then FAILED on the interaction-evidence gate —
+      // the oracle must say what verify will say, including this.
+      ...interactionEvidence.length > 0 && interactionCoverage(behaviors).interactionChecks === 0 ? { interactionEvidenceUnverified: true, verifyWillFail: "interaction-evidence \u2014 the recording proves interactive poses none of the authored behaviors cover; not fixable from component code; REPORT it, do not iterate on it" } : {},
       certification: { certified: certifiedReps.length, total: scores.length, bar: certBar, note: "tierOf on exact values + parity and absent-ink demotion; verify's composition checks can demote further" }
     },
     () => {
@@ -9849,12 +9979,18 @@ METRIC DEADBAND (read before iterating on near-misses): the scored similarity/in
 ${obj[0]}/${total} \xB7 certified ${certifiedReps.length}/${total} \xB7 floor=${obj[1].toFixed(3)} \xB7 mean=${obj[2].toFixed(3)} \xB7 evidence: ${evidenceDir}
 `);
       const ic = interactionCoverage(behaviors);
-      if (ic.interactionChecks === 0) {
+      if (interactionEvidence.length > 0 && ic.interactionChecks === 0) {
+        process.stdout.write(`INSTRUMENT GAP \u2014 the recording proves interactive poses (${interactionEvidence.join(", ")}) and zero interaction behaviors were authored; verify WILL fail this bundle (interaction-evidence). Not fixable from component code \u2014 report it, do not iterate on it.
+`);
+      } else if (ic.interactionChecks === 0) {
         process.stdout.write(`UNVERIFIED operability \u2014 0 interaction checks; the behaviour passes above are page-level style hygiene
 `);
       }
     }
   );
+  if (absentAtCertBar.length > 0) {
+    warn(opts, `${absentAtCertBar.length} config(s) carry absent-ink clusters (${absentAtCertBar.join(", ")}) \u2014 at --bar cert these fail the run; the MISSING FEATURES block above names each one`);
+  }
   if (opts.bar === "cert" && substitutedFamilies.length > 0) {
     const names = substitutedFamilies.map((f) => `"${f}"`).join(", ");
     if (opts.json) {
@@ -10135,6 +10271,14 @@ var init_server = __esm({
           return argvOut;
         }
       },
+      {
+        name: "tendril_permissions",
+        description: "Install the Claude Code permission allowlist for the Tendril pipeline (write: true \u2014 merges per-tool entries into the project's .claude/settings.local.json, idempotent, never touches other settings), or list the entries without writing. USE THIS when tendril/Figma tool calls keep hitting permission prompts: offer it to the user once \u2014 ONE approval here replaces a prompt per pipeline call (run 8 measured 16+ prompts for a single component's recording). The user must reload the session for new settings to apply.",
+        schema: z12.object({
+          write: z12.boolean().optional().describe("true = install into .claude/settings.local.json (the point of this tool); false/absent = just return the entries")
+        }),
+        argv: (i) => ["permissions", "--claude", ...i["write"] === true ? ["--write"] : []]
+      },
       {
         name: "tendril_doctor",
         annotations: { readOnlyHint: true },
@@ -10330,7 +10474,7 @@ var init_server = __esm({
       },
       {
         name: "tendril_verify",
-        description: "Verify/check that a component matches its Figma design \u2014 use when the user asks whether an implementation is faithful to the design, or to re-certify an existing Tendril bundle. Recomputes full verification (per-config status, behaviors, composition, evidence artifacts). Free, account-less, network-less \u2014 the trust anchor. Exit 5 means sub-bar with an honest report.",
+        description: "Verify/check that a component matches its Figma design \u2014 use when the user asks whether an implementation is faithful to the design, or to re-certify an existing Tendril bundle. Recomputes full verification (per-config status, behaviors, composition, evidence artifacts). Free, account-less, network-less \u2014 the trust anchor. Exit 5 means below the target bar with an honest report \u2014 sub-bar scores, or at bar cert a config demoted by absent-ink clusters.",
         schema: z12.object({
           bundleDir: str("bundle directory to verify"),
           bar: optStr("pass (default) or cert"),
@@ -10378,8 +10522,33 @@ var permissions_exports = {};
 __export(permissions_exports, {
   PERMISSIONS_DESCRIPTION: () => PERMISSIONS_DESCRIPTION,
   buildPermissions: () => buildPermissions,
+  mergeAllowlist: () => mergeAllowlist,
   runPermissions: () => runPermissions
 });
+import { existsSync as existsSync29, mkdirSync as mkdirSync9, readFileSync as readFileSync26, writeFileSync as writeFileSync15 } from "node:fs";
+import os7 from "node:os";
+import path35 from "node:path";
+function mergeAllowlist(file, entries) {
+  let settings = {};
+  if (existsSync29(file) && readFileSync26(file, "utf8").trim() !== "") {
+    settings = JSON.parse(readFileSync26(file, "utf8"));
+    if (settings === null || typeof settings !== "object" || Array.isArray(settings)) throw new Error("settings root is not an object");
+  }
+  const permissions = settings["permissions"] ??= {};
+  if (permissions === null || typeof permissions !== "object" || Array.isArray(permissions)) throw new Error("permissions is not an object");
+  const allow = permissions["allow"] ??= [];
+  if (!Array.isArray(allow)) throw new Error("permissions.allow is not an array");
+  const present = new Set(allow.filter((x) => typeof x === "string"));
+  const added = entries.filter((e) => !present.has(e));
+  const alreadyPresent = entries.filter((e) => present.has(e));
+  if (added.length > 0) {
+    allow.push(...added);
+    mkdirSync9(path35.dirname(file), { recursive: true });
+    writeFileSync15(file, `${JSON.stringify(settings, null, 2)}
+`);
+  }
+  return { added, alreadyPresent };
+}
 async function buildPermissions(options) {
   const LEGAL_TOOL_NAME = /^[A-Za-z0-9_-]+$/;
   const pipeline = new Set(FIGMA_TOOL_FALLBACK);
@@ -10408,11 +10577,44 @@ async function runPermissions(flags) {
     return;
   }
   const result = await buildPermissions({ ...flags.mcpUrl ? { mcpUrl: flags.mcpUrl } : {} });
+  if (flags.write) {
+    const base = process.env["INIT_CWD"] ?? process.cwd();
+    const file = flags.user ? path35.join(os7.homedir(), ".claude", "settings.json") : path35.join(base, ".claude", "settings.local.json");
+    if (flags.dryRun) {
+      emitData(flags, { file, wouldAdd: result.toolEntries }, () => {
+        process.stdout.write(`dry-run: would merge ${result.toolEntries.length} per-tool entries into ${file}
+`);
+      });
+      return;
+    }
+    try {
+      const { added, alreadyPresent } = mergeAllowlist(file, result.toolEntries);
+      emitData(flags, { ...result, written: { file, added, alreadyPresent } }, () => {
+        process.stdout.write(
+          added.length === 0 ? `already installed: all ${alreadyPresent.length} Tendril pipeline entries present in ${file}
+` : `installed: ${added.length} allowlist entr${added.length === 1 ? "y" : "ies"} added to ${file}${alreadyPresent.length > 0 ? ` (${alreadyPresent.length} already present)` : ""}
+  restart or reopen the Claude Code session to pick up settings changes
+`
+        );
+      });
+    } catch (err) {
+      fail(flags, ExitCode.InputValidation, {
+        error: `cannot rewrite ${file}: ${err instanceof Error ? err.message.split("\n")[0] : String(err)}`,
+        code: "settings-unwritable",
+        remediation: "The file is not plain JSON this command can faithfully re-emit (comments or an unexpected shape). Add the entries by hand: run without --write for the paste-ready block."
+      });
+    }
+    return;
+  }
   emitData(flags, result, () => {
     const quoted = (xs) => xs.map((x) => `    ${JSON.stringify(x)}`).join(",\n");
     process.stdout.write(
       `Claude Code allowlist for the Tendril pipeline.
-Paste into .claude/settings.json under permissions.allow:
+One command installs it (project-local, idempotent):
+
+    tendril permissions --claude --write
+
+Or paste into .claude/settings.json under permissions.allow:
 
 ${quoted(result.toolEntries)}
 
@@ -10431,6 +10633,7 @@ var FIGMA_TOOL_FALLBACK, PERMISSIONS_DESCRIPTION, TENDRIL_PLUGIN_PREFIX, FIGMA_P
 var init_permissions = __esm({
   "packages/cli/src/commands/permissions.ts"() {
     "use strict";
+    init_src3();
     init_src();
     init_server();
     init_describe();
@@ -10439,10 +10642,12 @@ var init_permissions = __esm({
     FIGMA_TOOL_FALLBACK = ["get_metadata", "get_design_context", "get_screenshot", "get_variable_defs", "get_motion_context", "get_figjam"];
     PERMISSIONS_DESCRIPTION = {
       name: "permissions",
-      summary: "Print a paste-ready Claude Code permission allowlist for the Tendril pipeline (tendril + Figma MCP tools).",
+      summary: "Install (or print) the Claude Code permission allowlist for the Tendril pipeline (tendril + Figma MCP tools).",
       args: [],
       flags: [
-        { flag: "--claude", description: "Claude Code settings.json format (the default and currently only format)" },
+        { flag: "--claude", description: "Claude Code settings format (the default and currently only format)" },
+        { flag: "--write", description: "Merge the per-tool entries into .claude/settings.local.json in the current project (idempotent; creates the file; never touches other keys)" },
+        { flag: "--user", description: "With --write: target ~/.claude/settings.json (every project) instead of the project-local file" },
         { flag: "--mcp-url <url>", description: "Figma MCP endpoint to list live tool names from", default: DEFAULT_MCP_URL },
         { flag: "--json", description: "Machine-readable output" }
       ],
@@ -10450,16 +10655,134 @@ var init_permissions = __esm({
         host: '"claude"',
         serverEntries: "string[] \u2014 one entry per MCP server (allows every tool it serves)",
         toolEntries: "string[] \u2014 per-tool entries for selective allowlists",
-        directConfigNote: "string \u2014 prefix rewrite for non-plugin (claude mcp add) installs"
+        directConfigNote: "string \u2014 prefix rewrite for non-plugin (claude mcp add) installs",
+        written: "with --write: { file, added, alreadyPresent }"
       },
-      exitCodes: { 0: "always (informational)" },
-      examples: ["tendril permissions --claude", "tendril permissions --claude --json"]
+      exitCodes: { 0: "printed or written", 3: "with --write: the target file exists but is not JSON this command can safely rewrite" },
+      examples: ["tendril permissions --claude --write", "tendril permissions --claude", "tendril permissions --claude --json"]
     };
     TENDRIL_PLUGIN_PREFIX = "mcp__plugin_tendril_tendril";
     FIGMA_PLUGIN_PREFIX = "mcp__plugin_figma_figma";
   }
 });
 
+// packages/cli/src/commands/inspect.ts
+var inspect_exports = {};
+__export(inspect_exports, {
+  INSPECT_DESCRIPTION: () => INSPECT_DESCRIPTION,
+  runInspect: () => runInspect
+});
+import { existsSync as existsSync30, readFileSync as readFileSync27, writeFileSync as writeFileSync16 } from "node:fs";
+import path36 from "node:path";
+async function runInspect(opts) {
+  if (opts.describe) {
+    printDescription(INSPECT_DESCRIPTION);
+    return;
+  }
+  const bundleDir = path36.resolve(opts.bundleDir);
+  const evidenceDir = path36.join(bundleDir, "verify-evidence");
+  const manifestPath2 = path36.join(bundleDir, "component.json");
+  if (!existsSync30(evidenceDir) || !existsSync30(manifestPath2)) {
+    fail(opts, ExitCode.InputValidation, {
+      error: `nothing to inspect in ${bundleDir} \u2014 ${existsSync30(manifestPath2) ? "no verify-evidence directory" : "no component.json"}`,
+      code: "no-evidence",
+      remediation: "Run `tendril verify <bundleDir>` first \u2014 inspect reads the ref/render evidence that run writes."
+    });
+  }
+  const { manifest } = readBundleManifest(readFileSync27(manifestPath2, "utf8"));
+  if (manifest === void 0) {
+    fail(opts, ExitCode.InputValidation, {
+      error: "component.json did not parse as a bundle manifest",
+      code: "no-mount-contract",
+      remediation: "Re-emit the bundle (score/verify rewrite component.json), then re-run inspect."
+    });
+  }
+  const setDir = path36.resolve(opts.set ?? manifest.provenance.recordingSet.path);
+  const reps = Object.keys(manifest.propAdapter).filter((rep) => existsSync30(path36.join(evidenceDir, `${rep}-ref.png`)) && existsSync30(path36.join(evidenceDir, `${rep}-render.png`)));
+  if (reps.length === 0) {
+    fail(opts, ExitCode.InputValidation, {
+      error: "verify-evidence holds no ref/render pairs for this bundle's configs",
+      code: "no-evidence",
+      remediation: "Run `tendril verify <bundleDir>` first \u2014 inspect reads the ref/render evidence that run writes."
+    });
+  }
+  let crops = 0;
+  const sections = [];
+  for (const rep of reps) {
+    const ref = new Uint8Array(readFileSync27(path36.join(evidenceDir, `${rep}-ref.png`)));
+    const render = new Uint8Array(readFileSync27(path36.join(evidenceDir, `${rep}-render.png`)));
+    const nodes = smallSemanticNodes(setDir, rep, opts.maxArea ?? 1024).slice(0, 12);
+    const cells = [];
+    for (const [i, n] of nodes.entries()) {
+      const rect = { x: n.x, y: n.y, w: n.w, h: n.h };
+      try {
+        writeFileSync16(path36.join(evidenceDir, `${rep}-inspect-${i}-ref.png`), zoomCrop(ref, rect));
+        writeFileSync16(path36.join(evidenceDir, `${rep}-inspect-${i}-render.png`), zoomCrop(render, rect));
+      } catch {
+        continue;
+      }
+      crops += 1;
+      cells.push(
+        `<figure><figcaption>${esc(n.name)} <code>${esc(n.id)}</code> \xB7 ${n.w}\xD7${n.h}</figcaption><div class="pair"><span><em>recorded</em><img src="./${rep}-inspect-${i}-ref.png" alt="recorded ${esc(n.name)}"></span><span><em>rendered</em><img src="./${rep}-inspect-${i}-render.png" alt="rendered ${esc(n.name)}"></span></div></figure>`
+      );
+    }
+    sections.push(
+      `<section><h2>${esc(rep)}</h2><div class="full"><span><em>recorded</em><img src="./${rep}-ref.png"></span><span><em>rendered</em><img src="./${rep}-render.png"></span><span><em>diff</em><img src="./${rep}-diff.png"></span></div>` + (cells.length > 0 ? `<div class="grid">${cells.join("")}</div>` : `<p class="none">no small recorded nodes in this config's sweep</p>`) + `</section>`
+    );
+  }
+  const sheet = path36.join(evidenceDir, "inspect.html");
+  writeFileSync16(
+    sheet,
+    `<!doctype html><meta charset="utf-8"><title>${esc(manifest.name)} \u2014 tendril inspect</title><style>
+body{font:14px/1.45 system-ui,sans-serif;margin:24px;background:#fff;color:#111}
+h1{font-size:20px} h2{font-size:16px;border-top:1px solid #ddd;padding-top:16px}
+.pair,.full{display:flex;gap:12px;flex-wrap:wrap;align-items:flex-start}
+.full img{max-width:400px;border:1px solid #ccc} .pair img{border:1px solid #ccc;image-rendering:pixelated}
+figure{margin:0 0 16px} figcaption{margin-bottom:4px} em{display:block;color:#666;font-style:normal;font-size:12px}
+.grid{display:flex;flex-wrap:wrap;gap:20px;margin-top:12px} .none{color:#666}
+</style><h1>${esc(manifest.name)} \u2014 detail sheet (small recorded nodes, recorded vs rendered)</h1>
+<p>Every crop is a recorded node small enough that global metrics weight it as a rounding error.
+Scan the pairs: anything present on the left and missing/invisible on the right is a defect,
+whatever the scores said. Verdicts come from <code>tendril verify</code> \u2014 this sheet only shows.</p>
+${sections.join("\n")}
+`
+  );
+  emitData(opts, { sheet, configs: reps.length, crops }, () => {
+    process.stdout.write(`inspect sheet: ${sheet}
+${reps.length} config(s), ${crops} detail crop pair(s) \u2014 open the sheet and scan recorded vs rendered
+`);
+  });
+}
+var INSPECT_DESCRIPTION, esc;
+var init_inspect = __esm({
+  "packages/cli/src/commands/inspect.ts"() {
+    "use strict";
+    init_src3();
+    init_src6();
+    init_src4();
+    init_describe();
+    init_output();
+    INSPECT_DESCRIPTION = {
+      name: "inspect",
+      summary: "Build an eye-verifiable detail sheet from verify evidence: magnified ref-vs-render crops of every small recorded node (icons, controls, marks).",
+      args: [{ name: "bundleDir", required: true, description: "bundle directory (must carry component.json and a verify-evidence dir from a prior `tendril verify`)" }],
+      flags: [
+        { flag: "--set <dir>", description: "recording set override (default: the bundle's provenance path)" },
+        { flag: "--max-area <px2>", description: "node area ceiling for the detail sweep", default: "1024" },
+        { flag: "--json", description: "Machine-readable output" }
+      ],
+      output: {
+        sheet: "string \u2014 path to the generated inspect.html",
+        configs: "number \u2014 configs with evidence found",
+        crops: "number \u2014 detail crop pairs written"
+      },
+      exitCodes: { 0: "sheet written", 3: "no verify evidence to inspect (run `tendril verify` first)" },
+      examples: ["tendril inspect ./src/components/Banner", "tendril inspect ./bundle --set ./tendril/recordings/banner"]
+    };
+    esc = (s) => s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+  }
+});
+
 // packages/cli/src/commands/generate-route.ts
 var generate_route_exports = {};
 __export(generate_route_exports, {
@@ -10484,17 +10807,17 @@ __export(generate_recorded_exports, {
   runGenerateRecorded: () => runGenerateRecorded
 });
 import { confirm as confirm3, isCancel as isCancel3 } from "@clack/prompts";
-import { existsSync as existsSync29, readFileSync as readFileSync26 } from "node:fs";
-import path35 from "node:path";
+import { existsSync as existsSync31, readFileSync as readFileSync28 } from "node:fs";
+import path37 from "node:path";
 async function runGenerateRecorded(opts) {
   const callerCwd = process.env["INIT_CWD"] ?? process.cwd();
-  const outDirAbs = path35.resolve(callerCwd, opts.out);
-  const recordedAsPath = path35.resolve(callerCwd, opts.recorded);
+  const outDirAbs = path37.resolve(callerCwd, opts.out);
+  const recordedAsPath = path37.resolve(callerCwd, opts.recorded);
   let task;
   let taskName;
   let authoredApi;
   let composition;
-  const isSet = existsSync29(path35.join(recordedAsPath, "recording-set.json"));
+  const isSet = existsSync31(path37.join(recordedAsPath, "recording-set.json"));
   const registry = TASKS[opts.recorded];
   if (registry !== void 0 && !isSet) {
     task = registry;
@@ -10503,7 +10826,7 @@ async function runGenerateRecorded(opts) {
     try {
       const authored = authorTaskFromSet(recordedAsPath);
       task = authored.task;
-      taskName = path35.basename(recordedAsPath);
+      taskName = path37.basename(recordedAsPath);
       authoredApi = authored.api;
       const roles = RolesSchema.safeParse(loadManifest(recordedAsPath).roles);
       if (roles.success) composition = roles.data;
@@ -10533,8 +10856,11 @@ async function runGenerateRecorded(opts) {
   if (substitutedFamilies.length > 0) {
     warn(opts, `substituted fonts: cache lacks ${substitutedFamilies.map((f) => `"${f}"`).join(", ")} \u2014 scores measure a substitute face and no config can be certified under one (the stamp covers only the provisioned subset); resolve the families to certify`);
   }
+  for (const g of missingWeights(task.set)) {
+    warn(opts, `font weights (advisory): the recording implies weights ${g.declared.join(", ")} for "${g.family}" \u2014 cache provides ${g.provided.join(", ")}; nearest-weight rendering may shift stroke density (certification stays family-gated; implied weights can leak across families)`);
+  }
   const missing = task.configs.filter(
-    (c) => !existsSync29(path35.join(task.set, c.rep, "get_screenshot.json")) || !existsSync29(path35.join(task.set, c.rep, "get_metadata.json")) || !existsSync29(path35.join(task.set, c.rep, "get_design_context.json"))
+    (c) => !existsSync31(path37.join(task.set, c.rep, "get_screenshot.json")) || !existsSync31(path37.join(task.set, c.rep, "get_metadata.json")) || !existsSync31(path37.join(task.set, c.rep, "get_design_context.json"))
   );
   if (missing.length > 0) {
     fail(opts, ExitCode.RecordingIncomplete, {
@@ -10604,8 +10930,8 @@ async function runGenerateRecorded(opts) {
 ` : `${line}
 `);
   if (opts.dryRun) {
-    emitData(opts, { dryRun: true, task: taskName, model: modelId, consent, wouldWrite: path35.join(outDirAbs, taskName) }, () => {
-      process.stdout.write(`dry-run: nothing sent, nothing written (would write ${path35.join(outDirAbs, taskName)})
+    emitData(opts, { dryRun: true, task: taskName, model: modelId, consent, wouldWrite: path37.join(outDirAbs, taskName) }, () => {
+      process.stdout.write(`dry-run: nothing sent, nothing written (would write ${path37.join(outDirAbs, taskName)})
 `);
     });
     return;
@@ -10628,10 +10954,10 @@ async function runGenerateRecorded(opts) {
       });
     }
   }
-  const bundleDir = path35.join(outDirAbs, taskName);
-  if (existsSync29(path35.join(bundleDir, "component.json"))) {
+  const bundleDir = path37.join(outDirAbs, taskName);
+  if (existsSync31(path37.join(bundleDir, "component.json"))) {
     try {
-      const prior = readBundleManifest(readFileSync26(path35.join(bundleDir, "component.json"), "utf8")).manifest;
+      const prior = readBundleManifest(readFileSync28(path37.join(bundleDir, "component.json"), "utf8")).manifest;
       if (prior !== void 0 && prior.provenance.recordingSet.hash !== recordingSetHash(task.set, task.configs)) {
         fail(opts, ExitCode.InputValidation, {
           error: `${bundleDir} already holds a bundle bound to recording set "${prior.provenance.recordingSet.path}" \u2014 generating here against a different set would silently rewrite its verification identity`,
@@ -10644,6 +10970,7 @@ async function runGenerateRecorded(opts) {
     }
   }
   const result = await runEngineLoop({
+    absentInkGates: opts.bar === "cert",
     engine,
     segments,
     brief,
@@ -10663,12 +10990,13 @@ async function runGenerateRecorded(opts) {
   });
   const statuses = result.finalScores.map((s) => ({
     ...s,
-    status: s.similarity >= BARS4.cert.sim && s.inkRecall >= BARS4.cert.ink && substitutedFamilies.length === 0 ? "certified" : s.pass ? "pass" : "fail"
+    status: (s.exact?.similarity ?? s.similarity) >= BARS4.cert.sim && (s.exact?.inkRecall ?? s.inkRecall) >= BARS4.cert.ink && substitutedFamilies.length === 0 && (s.absentInk?.length ?? 0) === 0 ? "certified" : s.pass ? "pass" : "fail"
   }));
   const behaviorFailures = result.finalBehaviors.filter((b) => !b.pass);
   const pixelFailures = statuses.filter((s) => s.status === "fail");
   const certified = statuses.filter((s) => s.status === "certified").length;
-  const ok = result.best !== void 0 && pixelFailures.length === 0 && behaviorFailures.length === 0;
+  const absentAtCertBar = opts.bar === "cert" ? result.finalScores.filter((s) => (s.absentInk?.length ?? 0) > 0).map((s) => s.rep) : [];
+  const ok = result.best !== void 0 && pixelFailures.length === 0 && behaviorFailures.length === 0 && absentAtCertBar.length === 0;
   let trustStatement;
   if (result.best !== void 0) {
     const emitted = emitBundleV1({
@@ -10732,18 +11060,23 @@ ${certified}/${statuses.length} certified \xB7 ${statuses.length - pixelFailures
   );
   if (opts.bar === "cert" && substitutedFamilies.length > 0) {
     const names = substitutedFamilies.map((f) => `"${f}"`).join(", ");
+    const alsoAbsent = absentAtCertBar.length > 0 ? ` \u2014 and ${absentAtCertBar.length} config(s) also carry absent-ink clusters; certification requires fixing those too` : "";
     if (opts.json) {
-      process.stderr.write(`${JSON.stringify({ error: `font cache lacks ${names} \u2014 certification never measures a substitute face (scores above are pass-capped)`, code: "fonts-unproven", remediation: fontsUnprovenRemediation(task.set) })}
+      process.stderr.write(`${JSON.stringify({ error: `font cache lacks ${names} \u2014 certification never measures a substitute face (scores above are pass-capped)${alsoAbsent}`, code: "fonts-unproven", remediation: fontsUnprovenRemediation(task.set) })}
 `);
     } else {
-      process.stderr.write(`error (fonts-unproven): font cache lacks ${names} \u2014 certification never measures a substitute face (scores above are pass-capped)
+      process.stderr.write(`error (fonts-unproven): font cache lacks ${names} \u2014 certification never measures a substitute face (scores above are pass-capped)${alsoAbsent}
   \u2192 ${fontsUnprovenRemediation(task.set)}
 `);
     }
     process.exitCode = ExitCode.FontsUnproven;
     return;
   }
-  if (!ok) {
+  if (absentAtCertBar.length > 0) {
+    warn(opts, `${absentAtCertBar.length} config(s) carry absent-ink clusters (${absentAtCertBar.join(", ")}) \u2014 certification never ships a missing or invisible feature (1B); fix the component or run at --bar pass for the disclosed result`);
+    process.exitCode = ExitCode.VerificationFailed;
+  }
+  if (!ok && (pixelFailures.length > 0 || behaviorFailures.length > 0 || result.best === void 0)) {
     warn(opts, `${pixelFailures.length} config(s) and ${behaviorFailures.length} behavior(s) below the ${opts.bar} bar \u2014 bundle written, verdict honest (Q4)`);
     process.exitCode = ExitCode.VerificationFailed;
   }
@@ -11789,11 +12122,27 @@ function buildProgram() {
       ...local["out"] !== void 0 ? { out: local["out"] } : {}
     });
   });
-  program.command("permissions").description("Print a paste-ready Claude Code permission allowlist for the Tendril pipeline (tendril + Figma MCP tools) \u2014 no more transcribing tool names from prompts.").option("--claude", "Claude Code settings.json format (the default and currently only format)").option("--mcp-url <url>", "Figma MCP endpoint to list live tool names from").action(async (_o, cmd) => {
+  program.command("permissions").description("Install (or print) the Claude Code permission allowlist for the Tendril pipeline (tendril + Figma MCP tools) \u2014 no more transcribing tool names from prompts.").option("--claude", "Claude Code settings format (the default and currently only format)").option("--write", "merge the per-tool entries into .claude/settings.local.json in the current project (idempotent; never touches other keys)").option("--user", "with --write: target ~/.claude/settings.json (every project) instead").option("--mcp-url <url>", "Figma MCP endpoint to list live tool names from").action(async (_o, cmd) => {
     const flags = globalFlags(cmd.parent);
     const local = cmd.opts();
     const { runPermissions: runPermissions2 } = await Promise.resolve().then(() => (init_permissions(), permissions_exports));
-    await runPermissions2({ ...flags, ...local["mcpUrl"] !== void 0 ? { mcpUrl: local["mcpUrl"] } : {} });
+    await runPermissions2({
+      ...flags,
+      ...local["write"] !== void 0 ? { write: local["write"] } : {},
+      ...local["user"] !== void 0 ? { user: local["user"] } : {},
+      ...local["mcpUrl"] !== void 0 ? { mcpUrl: local["mcpUrl"] } : {}
+    });
+  });
+  program.command("inspect").description("Build an eye-verifiable detail sheet from verify evidence: magnified recorded-vs-rendered crops of every small recorded node (icons, controls, marks) plus full-frame triples, in one static HTML page.").argument("<bundleDir>", "bundle directory with component.json and verify-evidence").option("--set <dir>", "recording set override (default: the bundle's provenance path)").option("--max-area <px2>", "node area ceiling for the detail sweep", "1024").action(async (bundleDir, _o, cmd) => {
+    const flags = globalFlags(cmd.parent);
+    const local = cmd.opts();
+    const { runInspect: runInspect2 } = await Promise.resolve().then(() => (init_inspect(), inspect_exports));
+    await runInspect2({
+      ...flags,
+      bundleDir,
+      ...local["set"] !== void 0 ? { set: local["set"] } : {},
+      ...local["maxArea"] !== void 0 ? { maxArea: Number(local["maxArea"]) } : {}
+    });
   });
   program.command("verify").description("Recompute verification for a generated bundle against its recording set (per-config status, behaviors, honest exit codes).").argument("<bundleDir>", "bundle directory to verify").option("--task <name>", "legacy task adapter for bundles WITHOUT component.json (bundle v1 carries its own prop manifest)").option("--set <dir>", "recording set directory (overrides the bundle's provenance path)").option("--bar <bar>", "target bar: pass (0.95) or cert (0.97)", "pass").action(async (bundleDir, _opts, cmd) => {
     const flags = globalFlags(cmd);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tendrilapp/cli",
-  "version": "0.1.18",
+  "version": "0.1.19",
   "description": "Figma design systems → verified React components. CLI ruler + MCP server.",
   "license": "SEE LICENSE IN LICENSE",
   "type": "module",