@tendrilapp/cli 0.1.24 → 0.1.25

package/dist/SKILL.md

@@ -69,13 +69,29 @@ fidelity gap" was a missing font weight one check away; a stop rule is
 for avoiding thrash, never for converting an unverified hypothesis into
 a final answer.
 
+Concurrency, whether that is several components in one session or one
+large set:
+- Every agent in flight spends ONE shared Figma budget, and Figma
+  meters per minute as well as per day, so parallelism sets the burst
+  rate. Scale recorders to the total pose count: up to ~30 poses,
+  four; ~30–100 poses, two; beyond ~100 poses, record serially and
+  pace it — a large set has no slack to burn on a per-minute limit.
+  A measured 8-wide batch hit its rate limit (per-piece resume
+  recovered, but the stall is avoidable).
+- COUNT EVERY AGENT THAT CALLS FIGMA, not every agent you launched:
+  a recorder NEVER spawns its own recorders. It records the queue it
+  was handed and stops. A measured 4-wide run peaked at double the
+  intended rate because two recorders spawned children that kept
+  calling after their parents reported done — the parent's "done" is
+  not proof its calls have stopped. To split a large queue further,
+  hand out the extra slices yourself so the whole count stays in one
+  place.
+
 Batch runs (several components in one session):
-- Cap concurrent recorders at FOUR. All recorders share one Figma
-  desktop MCP server; a measured 8-wide batch hit its rate limit
-  (per-piece resume recovered, but the stall is avoidable).
 - Batch the questions: plan ALL sets first, then put every
-  defaults-to-confirm and the one model question to the user together
-  — never one dialog per component.
+  defaults-to-confirm, every missing-interaction-state disclosure and
+  the one model question to the user together — never one dialog per
+  component, and never mid-generation.
 - Create candidate directories with a bare `mkdir -p <dir>` — no
   `&&`-compounds. Compound variants each need their own permission
   approval; the bare form is one grant for the whole batch.
@@ -110,8 +126,34 @@ Batch runs (several components in one session):
      which X should it show?" — the heuristic's pick is Recommended;
      a different answer re-plans via `defaults` (free until the first
      envelope is ingested, frozen after).
-   Recording cost is stated in figmaCallEstimate, never asked about —
-   proceed with what the user provided.
+   - `interactionStatesToConfirm`: the component set has no hover,
+     focus or pressed variant, so nothing recorded shows how it looks
+     while someone is using it — and what is never recorded is never
+     checked. Say its `statement` and `designFix` as written. This one
+     is a DISCLOSURE, not a question: no answer is needed, nothing is
+     blocked, and the fix (if the user wants one) is a new variant in
+     Figma, not a change in the code. Say only what
+     `recordedVariants` contains — never guess from the component's
+     name what kind of control it is.
+   FEASIBILITY, before the first recording call: the plan output
+   states the call arithmetic for this queue (poses × calls per pose).
+   Turn it into a verdict with one free check — call the Figma
+   `whoami` tool, which names the seat and plan and is exempt from
+   Figma's tool-call limits, then divide the queue's call count by the
+   daily allowance that seat carries. Never quote an allowance from
+   memory; use the one whoami reports. If the set fits inside one
+   day, record and say nothing about cost — a set that comfortably
+   fits is not worth the user's attention. If it does NOT fit, stop
+   and tell the user in plain numbers before recording anything:
+   "336 poses × 3 = 1,008 Figma calls. Your Full seat on Professional
+   allows 200/day, so this set needs about 5 days." Then let them
+   choose: (a) pace it across days — a rate limit loses no recorded
+   work, the set persists after every pose and re-running the same
+   command resumes; (b) record fewer poses — theirs to decide alone,
+   because it buys calls with coverage and there is no tool for it:
+   they re-plan with `--sample` in their own terminal; (c) a seat or
+   plan with a larger daily allowance. Never sample on their behalf,
+   and never start a set you have computed cannot finish.
    Later, `tendril_engine_brief` may carry `fontProvisioning` (the
    design uses a family the local kit lacks). First run
    `tendril fonts resolve --set <recording-dir>` yourself — it fetches
@@ -146,7 +188,9 @@ Batch runs (several components in one session):
    from it. SPEED: after `plan` the whole queue is known and reps are
    independent — fan out across parallel subagents in any order (use
    the cheap `tendril-recorder` agent; recording is transcription,
-   not reasoning). HOST-POLICY GATE (measured, run 6): many hosts
+   not reasoning), with HOW MANY set by the concurrency rule above:
+   it scales down as poses go up, and no recorder spawns recorders.
+   HOST-POLICY GATE (measured, run 6): many hosts
    forbid spawning subagents unless the user requested it, and the
    cost of not delegating is invisible until paid (12 hand-recorded
    reps ≈ 45k main-context tokens that cheap recorders absorb at ~11k

package/dist/tendril-mcp.js

@@ -25,7 +25,7 @@ var optStr = (d) => z.string().optional().describe(d);
 var TOOLS = [
   {
     name: "tendril_record_plan",
-    description: "ENTRY POINT for implementing/building a React component from a Figma design or figma.com URL \u2014 start the Tendril pipeline here (after loading the tendril skill, if installed). Plans a recording session: computes the rep queue (anchor + one-factor + conflict crosses) from the verbatim get_metadata response (pass its blocks via metadataParts \u2014 no file to write) and persists the set manifest. Resumes if the set already exists. The output may carry USER QUESTIONS \u2014 defaultsToConfirm (which pose is the component's default) or a multiple-component-sets error (which set to record): render them to a present user and apply the answers via `defaults` / `componentSet`; non-interactive runs follow each question's stated fallback. Recording cost is stated in figmaCallEstimate, never asked about \u2014 proceed with what the user provided.",
+    description: "ENTRY POINT for implementing/building a React component from a Figma design or figma.com URL \u2014 start the Tendril pipeline here (after loading the tendril skill, if installed). Plans a recording session: computes the rep queue (anchor + one-factor + conflict crosses) from the verbatim get_metadata response (pass its blocks via metadataParts \u2014 no file to write) and persists the set manifest. Resumes if the set already exists. The output may carry USER QUESTIONS \u2014 defaultsToConfirm (which pose is the component's default) or a multiple-component-sets error (which set to record): render them to a present user and apply the answers via `defaults` / `componentSet`; non-interactive runs follow each question's stated fallback. It may also carry `interactionStatesToConfirm` \u2014 the recording holds no hover/focus/pressed state, so nothing shows how the component behaves when someone uses it: say its `statement` and `designFix` in that SAME one message (the fix is a Figma variant, not code). It is a disclosure, not a gate \u2014 no answer is required and recording proceeds regardless. The output also carries `feasibilityCheck`: the call arithmetic for this queue plus the free `whoami` check that turns it into a verdict \u2014 complete that handshake BEFORE the first recording call, and surface the verdict to the user when the set does not fit their daily allowance.",
     schema: z.object({
       setDir: str("recording set directory to create/resume"),
       component: str("component/system name"),

package/dist/tendril.js

@@ -928,6 +928,74 @@ var init_plan = __esm({
   }
 });
 
+// packages/figma/src/recording/envelope-content.ts
+function envelopeParts(payload) {
+  const content = payload?.content;
+  if (!Array.isArray(content)) return null;
+  const blocks = content;
+  const text = blocks.map((b) => typeof b.text === "string" ? b.text : "").filter((t) => t !== "").join("\n");
+  const image = blocks.find((b) => b.type === "image" && typeof b.data === "string");
+  return image === void 0 ? { text } : { text, imageData: image.data };
+}
+function namedCause(text, table) {
+  return table.find((entry) => entry.pattern.test(text))?.cause;
+}
+function jsonObjectPayload(text) {
+  try {
+    const value = JSON.parse(text);
+    return typeof value === "object" && value !== null && !Array.isArray(value) ? value : null;
+  } catch {
+    return null;
+  }
+}
+function checkEnvelopeContent(tool, payload) {
+  const parts = envelopeParts(payload);
+  if (parts === null) return { ok: true };
+  const { text, imageData } = parts;
+  const serviceError = namedCause(text, SERVICE_ERROR_SIGNATURES);
+  if (serviceError !== void 0) return { ok: false, reason: serviceError };
+  const reject = (expected) => {
+    const hint = namedCause(text, FAILURE_HINTS);
+    return { ok: false, reason: hint === void 0 ? expected : `${hint} \u2014 ${expected}` };
+  };
+  switch (tool) {
+    case "get_metadata":
+    case "get_metadata_interior":
+      return NODE_MARKUP.test(text) ? { ok: true } : reject('no node markup in the response (a get_metadata response contains elements like <symbol id="\u2026"> or <frame id="\u2026">)');
+    case "get_design_context":
+      return CODE_DECLARATION.test(text) || ANY_MARKUP.test(text) ? { ok: true } : reject("no code emission or markup in the response (a get_design_context response contains a component's code, or node markup when the design is too large)");
+    case "get_variable_defs":
+      return jsonObjectPayload(text) === null ? reject("the response is not a JSON object of variable definitions") : { ok: true };
+    case "get_screenshot": {
+      if (imageData === void 0) return reject("no image block in the response (a get_screenshot envelope carries base64 PNG bytes)");
+      const png = checkPngPayload(imageData);
+      return png.ok ? { ok: true } : reject(png.reason);
+    }
+  }
+}
+var NODE_MARKUP, ANY_MARKUP, CODE_DECLARATION, SERVICE_ERROR_SIGNATURES, FAILURE_HINTS;
+var init_envelope_content = __esm({
+  "packages/figma/src/recording/envelope-content.ts"() {
+    "use strict";
+    init_provided_recording();
+    NODE_MARKUP = /<[A-Za-z][\w:.-]*(?:\s[^>]*)?\sid="[^"]+"/;
+    ANY_MARKUP = /<[A-Za-z][\w:.-]*(?:\s[^>]*)?\/?>/;
+    CODE_DECLARATION = /(?:^|\n)[ \t]*(?:const|let|var|function|class|export|import|type|interface|async|@)\b/;
+    SERVICE_ERROR_SIGNATURES = [
+      { pattern: /reached the .{0,60}tool call limit/i, cause: "the Figma MCP reported that the account's tool-call limit is exhausted" },
+      { pattern: /tool call limit for your/i, cause: "the Figma MCP reported that the account's tool-call limit is exhausted" },
+      { pattern: /upgrade your (?:seat|plan)/i, cause: "the Figma MCP returned an upgrade/quota notice" }
+    ];
+    FAILURE_HINTS = [
+      { pattern: /\brate[- ]limit/i, cause: "the response looks like a rate-limit error" },
+      { pattern: /\b(?:429|too many requests)\b/i, cause: "the response looks like a rate-limit error" },
+      { pattern: /\b(?:quota|billing|subscription|seat)\b/i, cause: "the response looks like a quota/plan notice" },
+      { pattern: /\b(?:unauthorized|forbidden|not authorized|access denied|401|403)\b/i, cause: "the response looks like an authorization error" },
+      { pattern: /\b(?:error|failed|failure|timed out|timeout)\b/i, cause: "the response looks like an error message" }
+    ];
+  }
+});
+
 // packages/figma/src/recording/session.ts
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import path from "node:path";
@@ -1036,10 +1104,14 @@ function ingestEnvelope(setDir, slug, tool, payload) {
   if (!RECORD_TOOLS.includes(tool)) {
     throw new Error(`unknown tool "${tool}" \u2014 expected one of ${RECORD_TOOLS.join(", ")}`);
   }
+  const content = checkEnvelopeContent(tool, payload);
+  if (!content.ok) {
+    throw new Error(`${slug}/${tool} was NOT recorded \u2014 ${content.reason}. ${REINGEST_GUIDANCE}`);
+  }
   const schema = tool === "get_screenshot" ? ImageEnvelopeSchema : TextEnvelopeSchema;
   const parsed = schema.safeParse(payload);
   if (!parsed.success) {
-    throw new Error(`${slug}/${tool}: envelope rejected at the boundary: ${parsed.error.issues[0]?.message ?? "invalid"}`);
+    throw new Error(`${slug}/${tool} was NOT recorded \u2014 envelope rejected at the boundary: ${parsed.error.issues[0]?.message ?? "invalid"}. ${REINGEST_GUIDANCE}`);
   }
   const file = containedPath(setDir, slug, `${tool}.json`);
   mkdirSync(path.dirname(file), { recursive: true });
@@ -1076,12 +1148,13 @@ function ingestAsset(setDir, slug, name, content) {
   mkdirSync(path.dirname(file), { recursive: true });
   writeFileSync(file, content);
 }
-var RECORD_TOOLS, INTERIOR_TOOL, REQUIRED_TOOLS, SessionManifestSchema, manifestPath, PROTOCOL_ORDER, byProtocolOrder;
+var RECORD_TOOLS, INTERIOR_TOOL, REQUIRED_TOOLS, SessionManifestSchema, manifestPath, PROTOCOL_ORDER, byProtocolOrder, REINGEST_GUIDANCE;
 var init_session = __esm({
   "packages/figma/src/recording/session.ts"() {
     "use strict";
     init_svg_safety();
     init_provided_recording();
+    init_envelope_content();
     init_plan();
     RECORD_TOOLS = ["get_design_context", "get_metadata", "get_screenshot", "get_variable_defs", "get_metadata_interior"];
     INTERIOR_TOOL = "get_metadata_interior";
@@ -1120,6 +1193,7 @@ var init_session = __esm({
     manifestPath = (setDir) => path.join(setDir, "recording-set.json");
     PROTOCOL_ORDER = ["get_metadata", "get_design_context", "get_screenshot", "get_variable_defs", "get_metadata_interior"];
     byProtocolOrder = (tools) => [...tools].sort((a, b) => PROTOCOL_ORDER.indexOf(a) - PROTOCOL_ORDER.indexOf(b));
+    REINGEST_GUIDANCE = "Nothing was written. Recording persists per rep and resumes from disk, so re-run the same command with the real response; if the Figma MCP reported a tool-call or rate limit, wait for the quota to reset first.";
   }
 });
 
@@ -1216,6 +1290,7 @@ var init_src = __esm({
     init_axis_defaults();
     init_plan();
     init_session();
+    init_envelope_content();
     init_roles();
   }
 });
@@ -3740,7 +3815,7 @@ export function Button(props: {
   [key: string]: unknown; // MUST spread unknown props (incl. data-*) onto the root element
 })
 
-Rules: plain CSS in styles.css (tokens.css optional, loaded first) \u2014 no Tailwind, no imports beyond react/react-dom. disabled buttons are unfocusable; the spinner honors prefers-reduced-motion (animation: none under the media query). Interactive states are REAL (:hover, :focus-visible) AND statically forceable via the data-tendril-state attribute ("hover" | "focus-visible") spread onto the root; forced and real selectors must share one declaration block, e.g. :is(:hover, [data-tendril-state~="hover"]). The host sizes nothing: the button is its natural recorded size. Fonts: 'Inter' is provided. Inline all SVGs (loading spinner, icons).
+Rules: plain CSS in styles.css (tokens.css optional, loaded first) \u2014 no Tailwind, no imports beyond react/react-dom. disabled buttons are unfocusable; the spinner honors prefers-reduced-motion (animation: none under the media query). Interactive states are REAL (:hover, :focus-visible) AND statically forceable via the data-tendril-state attribute ("hover" | "focus-visible") spread onto the root; forced and real selectors must share one declaration block, e.g. :is(:hover, [data-tendril-state~="hover"]). ROOT SIZE IS YOURS AND PIXELS DO NOT CHECK IT, IN EITHER DIRECTION: the mount floors your root to the recorded box (#root > *{min-width:<recorded w>px;min-height:<recorded h>px} \u2014 a floor, never a cap) and the image the scorer compares is a CROP of that box. So a button that computes NARROWER or SHORTER is stretched back and captures byte-identically to a correct one (measured on a real <button>), and an oversized one shows only where its own border, radius or shadow lands back inside the crop. Take both root dimensions from the recorded box, never from a score. Fonts: 'Inter' is provided. Inline all SVGs (loading spinner, icons).
 
 BEHAVIORAL CONTRACT (machine-verified, gating): the root is a focusable <button> with cursor:pointer; real :hover visibly changes it; the loading spinner has a RUNNING CSS animation. Static lookalikes fail.`;
     COMBO_FIX = {
@@ -4426,7 +4501,7 @@ function fontStackFindings(sheets, coverage) {
         kind: "font-stack",
         file: sheet.file,
         line: stack.line,
-        message: `font-family ${stack.text} binds to '${family}', which the font kit provides at ${has} \u2014 CSS matches the FAMILY first and picks a weight only inside it (a later family is never consulted for a missing weight, and the prelude's font-synthesis: none rules out faux-bold), so text at weight ${list} ${renders}, silently. ` + (rescue !== void 0 ? `'${rescue}' in this same stack provides ${list}: list it first.` : `No family in this stack provides ${list} \u2014 if the recording shows ${unserved.length === 1 ? "that weight" : "those weights"}, run \`tendril fonts resolve "${family}" --weights ${unserved.join(" ")}\` and re-score.`) + " ADVISORY: quality feedback only \u2014 it never moves a score, a tier, or the verdict."
+        message: `font-family ${stack.text} binds to '${family}', which the font kit provides at ${has} \u2014 CSS matches the FAMILY first and picks a weight only inside it (a later family is never consulted for a missing weight, and the prelude's font-synthesis: none rules out faux-bold), so text at weight ${list} ${renders}, silently. ` + (rescue !== void 0 ? `'${rescue}' in this same stack provides ${list}: list it first.` : `No family in this stack provides ${list} \u2014 if the recording shows ${unserved.length === 1 ? "that weight" : "those weights"}, run \`tendril fonts resolve "${family}" --weights ${unserved.join(" ")}\` and re-score.`) + " ADVISORY: the finding gates nothing \u2014 but the wrong face changes pixels, and this fix alone took a measured run from 7 to 9 certified."
       });
     }
   }
@@ -7250,10 +7325,12 @@ var init_activate = __esm({
 var record_exports = {};
 __export(record_exports, {
   instanceLeads: () => instanceLeads,
+  interactionDisclosure: () => interactionDisclosure,
   isFigmaAssetUrl: () => isFigmaAssetUrl,
   isLocalAssetUrl: () => isLocalAssetUrl,
   narrowedRoles: () => narrowedRoles,
   nextPayload: () => nextPayload,
+  recordsInteractionState: () => recordsInteractionState,
   runRecordAsset: () => runRecordAsset,
   runRecordFetch: () => runRecordFetch,
   runRecordFinish: () => runRecordFinish,
@@ -7267,6 +7344,26 @@ import { existsSync as existsSync20, mkdtempSync as mkdtempSync2, readFileSync a
 import os5 from "node:os";
 import path26 from "node:path";
 import { writeFileSync as writeFileSync9 } from "node:fs";
+function recordsInteractionState(reports) {
+  const evident = (s) => stateTokens(s).some((t) => INTERACTION_EVIDENCE_VALUES.has(t));
+  return reports.some((r) => evident(r.axis) || r.domain.some(evident));
+}
+function interactionDisclosure(component, reports) {
+  const recordedVariants = reports.map((r) => ({ axis: r.axis, values: r.domain }));
+  const variantSummary = recordedVariants.length === 0 ? "" : recordedVariants.length === 1 ? `${recordedVariants[0].axis} variants for ${andList(recordedVariants[0].values)}` : `variants for ${andList(recordedVariants.map((v) => `${v.axis} (${andList(v.values)})`))}`;
+  const has = recordedVariants.length > 0;
+  const statement = `Your ${component} component ${has ? `has ${variantSummary} \u2014 but none of them is a hover, focus or pressed state` : "has no variants at all, so none of it is a hover, focus or pressed state"}. Nothing in the recording shows how ${component} looks when someone hovers it, tabs to it, or is using it, so Tendril has no picture of those to check the build against. Tendril still builds controls as real, working controls \u2014 never a static lookalike \u2014 and, with no focus state recorded, it uses the browser's own focus indicator rather than inventing a focus ring. You do not need to answer this: recording carries on either way.`;
+  const designFix = `If ${component} should look different when it is focused or hovered, that change belongs in Figma rather than in the code: add a Focus (or Hover) variant to the ${component} component set, record it, and Tendril will match it exactly. If ${component} is not something people interact with, there is nothing to do.`;
+  return {
+    component,
+    recordedVariants,
+    variantSummary,
+    statement,
+    designFix,
+    instruction: "DISCLOSURE, not a question. Say `statement` and `designFix` to a present user at PLAN time, in the SAME message as defaultsToConfirm and every other plan-time question \u2014 one message per session, never one per component and never mid-generation. No answer is required and nothing blocks; proceed with recording whatever they say. State ONLY what `recordedVariants` contains: never infer from the component's NAME what kind of control it is. Non-interactive runs: put the statement in your report.",
+    blocking: false
+  };
+}
 function symbolsFromMetadataEnvelope(file, sourceFrame) {
   const env = JSON.parse(readFileSync16(file, "utf8"));
   const text = env.content.map((c) => c.text ?? "").join("\n");
@@ -7420,8 +7517,47 @@ function runRecordPlan(opts) {
   const { manifest, plan, resumed, toppedUp } = planSet(opts.setDir, opts.component, symbols, { ...Object.keys(defaults).length > 0 ? { defaults } : {}, ...opts.sample === true ? { sample: true } : {} });
   const defaultReports = reportAxisDefaults(symbols, Object.keys(defaults).length > 0 ? defaults : void 0);
   const toConfirm = resumed ? [] : defaultReports.filter((r) => (r.rule === "non-interaction" || r.rule === "frequency") && r.domain.length > 1);
-  const callLow = manifest.reps.length * 3;
-  const callHigh = manifest.reps.length * 4;
+  const interactionStatesToConfirm = recordsInteractionState(defaultReports) ? void 0 : interactionDisclosure(manifest.component, defaultReports);
+  const poses = manifest.reps.length;
+  const callLow = poses * FIGMA_CALLS_PER_REP;
+  const callHigh = poses * FIGMA_CALLS_PER_REP_WORST;
+  const posesRemaining = sessionStatus(opts.setDir).reps.filter((r) => r.missing.length > 0).length;
+  const callsNeeded = posesRemaining * FIGMA_CALLS_PER_REP;
+  const callSentence = posesRemaining === poses ? `${poses} poses \xD7 ${FIGMA_CALLS_PER_REP} calls per pose = ${callsNeeded} Figma calls` : `${posesRemaining} poses still to record \xD7 ${FIGMA_CALLS_PER_REP} calls per pose = ${callsNeeded} Figma calls (${poses - posesRemaining} of ${poses} already on disk)`;
+  const arithmetic = `${callSentence} (up to ${posesRemaining * FIGMA_CALLS_PER_REP_WORST} if screenshots or assets need a second fetch)`;
+  const multiDay = callsNeeded > MULTI_DAY_CALL_THRESHOLD;
+  const feasibilityCheck = {
+    arithmetic,
+    callsNeeded,
+    callsWorstCase: posesRemaining * FIGMA_CALLS_PER_REP_WORST,
+    posesToRecord: posesRemaining,
+    callsPerPose: FIGMA_CALLS_PER_REP,
+    instruction: "BEFORE the first recording call, call the Figma MCP `whoami` tool \u2014 it names the seat and plan and is EXEMPT from Figma's tool-call limits, so this check costs nothing and spends no quota. Read the daily tool-call allowance for that seat/plan and divide: callsNeeded \xF7 allowance = days this set needs. Tendril owns the multiplication above; the allowance is Figma's and is theirs to change, so take it from whoami and never from memory.",
+    surface: multiDay ? "This set exceeds every daily allowance we have heard of, so it CANNOT finish in one day. State the verdict to the user in plain numbers BEFORE recording anything and let them choose from `options` \u2014 do not start on the assumption it will fit." : "Say nothing about cost if the division fits inside one day's allowance \u2014 a set that comfortably fits is not worth the user's attention. Surface the verdict and `options` only when it does not fit.",
+    verdictTemplate: `${callSentence}. Your <seat> seat on <plan> allows <allowance>/day. This set needs about <days> day(s) at that rate.`,
+    options: [
+      {
+        id: "pace",
+        decidedBy: "user, and you can carry it out",
+        text: "Spread the recording across days, staying inside the daily allowance. Nothing is lost at a limit: the set persists after every pose and re-running the same command resumes from disk, so a rate limit costs waiting, never recorded work."
+      },
+      {
+        id: "sample",
+        // Sampling trades away lattice coverage, so it stays a human
+        // decision structurally, not by instruction: it exists only as
+        // a CLI flag and the MCP surface has no parameter for it.
+        decidedBy: "HUMAN ONLY \u2014 offer it, never choose it, and you cannot run it",
+        text: "Record a reduced pose set (anchor + one-factor sweeps + conflict crosses) instead of the full variant matrix. This buys calls with coverage \u2014 sampling is blind to multi-axis interactions and the report discloses the poses it skipped \u2014 so only the user may accept that trade. There is no tool parameter for it; the user runs it themselves in their own terminal, before any pose is recorded.",
+        userRuns: [`rm ${path26.join(opts.setDir, "recording-set.json")}`, `${tendrilCommand(`record plan --set ${opts.setDir} --component ${manifest.component}`)} --sample`]
+      },
+      {
+        id: "larger-allowance",
+        decidedBy: "user",
+        text: "A seat or plan with a larger daily allowance, if their organisation allows it. Figma's terms, not ours \u2014 state it as an option, never as advice to spend money."
+      }
+    ],
+    limitHintIfWhoamiIsSilent: LIMIT_HINT
+  };
   emitData(
     opts,
     {
@@ -7437,11 +7573,19 @@ function runRecordPlan(opts) {
       ...metadataTruncated ? { metadataTruncated: true } : {},
       ...toppedUp !== void 0 ? { toppedUp } : {},
       notRecorded: manifest.notRecorded ?? null,
-      figmaCallEstimate: { reps: manifest.reps.length, calls: `~${callLow}\u2013${callHigh}` },
+      // The whole-set ledger, numbers only — what recording this queue
+      // from nothing costs. What it costs FROM HERE, and what to do
+      // about it, is feasibilityCheck's job.
+      figmaCallEstimate: { reps: poses, callsPerRep: FIGMA_CALLS_PER_REP, calls: `~${callLow}\u2013${callHigh}`, callsMin: callLow, callsMax: callHigh },
+      // A sibling of defaultsToConfirm: a handshake the agent completes
+      // with the user before the queue costs anything, not a field to
+      // relay as duration.
+      feasibilityCheck,
       // Cold-start fix (run 7): the first instruction rides the plan
       // response, so record_next is never needed to begin — it exists
       // only for resuming.
       next: nextPayload(opts.setDir),
+      ...interactionStatesToConfirm !== void 0 ? { interactionStatesToConfirm } : {},
       ...toConfirm.length > 0 ? {
         defaultsToConfirm: {
           instruction: "HEURISTIC defaults: the designer named no literal Default and no override was given, so the code guessed the component's zero point \u2014 the pose an empty-props mount shows and the pose behaviour checks aim at. When a USER is present, ask each question below BEFORE recording; if they pick a different value, re-run this exact plan command with --default <Axis>=<Value> (allowed until the first envelope is ingested; frozen with the recording after). Non-interactive: proceed with the resolved values and state them in your report.",
@@ -7454,6 +7598,42 @@ function runRecordPlan(opts) {
       } : {}
     },
     () => {
+      const writeFeasibility = () => {
+        if (callsNeeded === 0) return;
+        process.stdout.write(`recording cost: ${arithmetic}
+`);
+        if (multiDay) {
+          process.stdout.write(`FEASIBILITY: ${callsNeeded} calls exceeds every daily Figma allowance we have heard of \u2014 this CANNOT finish in one day.
+`);
+          process.stdout.write(`  ask Figma whoami (free \u2014 exempt from tool-call limits) for this seat's daily allowance, divide ${callsNeeded} by it, and say how many DAYS this needs before recording
+`);
+          process.stdout.write(`  (a) pace it across days \u2014 the set persists after every pose, so a rate limit costs waiting, never recorded work
+`);
+          process.stdout.write(`  (b) record fewer poses \u2014 YOUR call, not an agent's: delete recording-set.json and re-plan with --sample (buys calls with coverage)
+`);
+          process.stdout.write(`  (c) a seat or plan with a larger daily allowance
+`);
+        } else {
+          process.stdout.write(`FEASIBILITY: check ${callsNeeded} against this seat's daily Figma allowance (ask whoami \u2014 it is free) before recording; it only needs raising if it does not fit
+`);
+        }
+      };
+      const writeInteraction = () => {
+        if (interactionStatesToConfirm === void 0) return;
+        const d = interactionStatesToConfirm;
+        process.stdout.write(
+          `CONFIRM   states: ${d.component} records no hover, focus or pressed state${d.recordedVariants.length > 0 ? ` \u2014 it has ${d.variantSummary}` : " (it has no variants at all)"}
+`
+        );
+        process.stdout.write(`  nothing in the recording shows how it looks when someone hovers it, tabs to it, or is using it
+`);
+        process.stdout.write(`  Tendril still builds controls as real controls \u2014 never a static lookalike \u2014 and uses the browser's own focus indicator instead of inventing a focus ring
+`);
+        process.stdout.write(`  want a focus ring of your own? add a Focus variant to the ${d.component} component set in Figma and record again \u2014 Tendril will match it exactly
+`);
+        process.stdout.write(`  nothing to answer \u2014 recording carries on either way
+`);
+      };
       if (resumed) {
         if (opts.sample === true && (manifest.planMode ?? "sample") === "full") {
           process.stdout.write("NOTE: --sample has no effect on a resumed full-matrix set \u2014 delete recording-set.json to re-plan sampled (partial coverage is a deliberate choice)\n");
@@ -7467,18 +7647,20 @@ function runRecordPlan(opts) {
           process.stdout.write(`resumed existing plan (${manifest.reps.length} reps, ${manifest.planMode ?? "sample"} mode) \u2014 delete recording-set.json to re-plan
 `);
         }
+        writeFeasibility();
+        writeInteraction();
         return;
       }
       for (const r of plan.reps) process.stdout.write(`planned ${r.slug.padEnd(24)} ${r.nodeId} (${r.tier})
 `);
       if (plan.notRecorded.length > 0) process.stdout.write(`not recorded (${plan.notRecorded.length}): disclosed in the manifest
 `);
-      process.stdout.write(`estimated recording cost: ~${callLow}\u2013${callHigh} Figma calls for ${manifest.reps.length} reps
-`);
+      writeFeasibility();
       for (const q2 of toConfirm) {
         process.stdout.write(`CONFIRM   ${q2.axis}: default resolved to "${q2.value}" by heuristic (${q2.rule}) \u2014 ask the user; change with --default before recording
 `);
       }
+      writeInteraction();
     }
   );
 }
@@ -7632,6 +7814,14 @@ async function runRecordIngest(opts) {
         remediation: "Save the get_variable_defs response verbatim as a text envelope."
       });
     }
+    const content = checkEnvelopeContent("get_variable_defs", payload);
+    if (!content.ok) {
+      fail(opts, ExitCode.InputValidation, {
+        error: `set-level get_variable_defs was NOT recorded \u2014 ${content.reason}`,
+        code: "envelope-rejected",
+        remediation: REINGEST_GUIDANCE
+      });
+    }
     writeFileSync9(path26.join(opts.setDir, "get_variable_defs.json"), `${JSON.stringify(payload, null, 1)}
 `);
     emitData(opts, { ingested: "get_variable_defs", rep: "__set__", setLevel: true, next: nextPayload(opts.setDir) }, () => {
@@ -7656,7 +7846,7 @@ async function runRecordIngest(opts) {
     fail(opts, ExitCode.InputValidation, {
       error: err instanceof Error ? err.message : String(err),
       code: "envelope-rejected",
-      remediation: "The envelope failed boundary validation \u2014 record the tool response again, verbatim, and re-ingest."
+      remediation: "Fix what the error names, then re-run this exact command \u2014 recording resumes from disk, so nothing already recorded is lost."
     });
   }
 }
@@ -7891,7 +8081,7 @@ function runRecordFinish(opts) {
 `);
   }
 }
-var ENVELOPE_HELP, isAutoFetchAssetUrl, describeRoleLoss;
+var FIGMA_CALLS_PER_REP, FIGMA_CALLS_PER_REP_WORST, MULTI_DAY_CALL_THRESHOLD, LIMIT_HINT, stateTokens, MAX_SPOKEN_VALUES, andList, ENVELOPE_HELP, isAutoFetchAssetUrl, describeRoleLoss;
 var init_record = __esm({
   "packages/cli/src/commands/record.ts"() {
     "use strict";
@@ -7901,6 +8091,25 @@ var init_record = __esm({
     init_output();
     init_entitlement();
     init_invocation();
+    FIGMA_CALLS_PER_REP = 3;
+    FIGMA_CALLS_PER_REP_WORST = 4;
+    MULTI_DAY_CALL_THRESHOLD = 600;
+    LIMIT_HINT = {
+      status: "UNVERIFIED \u2014 recorded 2026-08-14 from Figma's published documentation and one field report; Figma changes these at will.",
+      use: "Use ONLY if whoami states no allowance, and say it is unverified when you show it. The allowance whoami reports always wins.",
+      perDayByPlan: {
+        "Dev/Full seat, Professional": "~200 tool calls/day",
+        "Dev/Full seat, Organization or Enterprise": "~600 tool calls/day",
+        Starter: "~6 tool calls/month"
+      },
+      burst: "A per-minute ceiling is documented alongside the daily one, so parallel recorders can trip a limit long before the daily budget runs out."
+    };
+    stateTokens = (s) => s.toLowerCase().replace(/[^a-z0-9]+/g, "-").split("-").filter((t) => t !== "");
+    MAX_SPOKEN_VALUES = 6;
+    andList = (items) => {
+      const shown = items.length <= MAX_SPOKEN_VALUES ? items : [...items.slice(0, MAX_SPOKEN_VALUES), `${items.length - MAX_SPOKEN_VALUES} more`];
+      return shown.length <= 1 ? shown[0] ?? "" : `${shown.slice(0, -1).join(", ")} and ${shown[shown.length - 1]}`;
+    };
     ENVELOPE_HELP = `Envelope format: text tools save {"content":[{"type":"text","text":"<VERBATIM response text incl. any Currently-selected-nodes block>"}]}; get_screenshot: do NOT download the image yourself \u2014 pass its image_url to \`${tendrilCommand("record fetch")}\` (MCP: tendril_record_fetch), which pulls the bytes to disk directly. That keeps the pixel ground truth out of your context and costs one approval instead of a shell command per asset. Assets are asset-<first-8-hex-of-figma-uuid>.<ext>; their URLs appear as const declarations inside the design-context text and also expire.`;
     isAutoFetchAssetUrl = (url) => isFigmaAssetUrl(url) || isLocalAssetUrl(url);
     describeRoleLoss = (loss) => loss.kind === "main" ? `drops main "${loss.main}"` : `stops "${loss.part}" being a part of main "${loss.main}"`;
@@ -8129,7 +8338,7 @@ ${preludeLines.join("\n")}` : ""}${absentLines.length > 0 ? `
 MISSING FEATURES (absent-ink clusters \u2014 recorded marks your render leaves out or paints invisibly; GATING at the cert bar. Fix the named node's ink \u2014 a config carrying one cannot certify):
 ${absentLines.join("\n")}` : ""}
 
-Fix the FAIL configs (region coordinates are in the recorded screenshot's frame; ink<1 means recorded foreground pixels your render does not cover). Reading the pair: ink=1 with LOW sim means nothing is MISSING (do not chase missing ink) \u2014 the same pixels are being painted wrong, and there are TWO causes. GEOMETRY: wrong position/size/radius; the diff shows shifted edges and bands. WRONG TEXT WEIGHT OR FACE: the diff shows a uniform haze over glyph runs; CSS binds the font FAMILY before the weight, a later family in the stack is never consulted for a weight the first one lacks, and font-synthesis: none rules out faux-bold \u2014 so a stack led by a family the kit holds at one weight renders every other weight in that face, silently. Check the font stack against the kit's cached faces before concluding geometry is at fault. LOW ink with high sim means recorded marks are absent or painted invisibly. Do not regress PASS configs. ${mode === "files" ? "Update the files in your candidate directory and re-run the score." : "Reply with the complete corrected files in the same FILE format."}`;
+Fix the FAIL configs (region coordinates are in the recorded screenshot's frame; ink<1 means recorded foreground pixels your render does not cover). Reading the pair: ink credits a recorded pixel when ANY render ink lands within 1px of it, so ink=1 proves coverage \u2014 not presence, shape, or colour. A wrong-shaped mark over the right region, or a wrong-coloured one that is still ink, scores 1.000; and a recorded mark within ~30 channel-sum of the backdrop (#f6f6f6 on white is 27) is not ink at all, so it can be absent at ink 1.000 with no MISSING line. With ink=1 AND low sim, coverage held while pixels differ, so start with the TWO causes below \u2014 but never read ink=1 as "nothing is missing": confirm every faint or small recorded mark (hairlines, dividers, low-contrast controls) exists in your render. GEOMETRY: wrong position/size/radius; the diff shows shifted edges and bands. WRONG TEXT WEIGHT OR FACE: the diff shows a uniform haze over glyph runs; CSS binds the font FAMILY before the weight, a later family in the stack is never consulted for a weight the first one lacks, and font-synthesis: none rules out faux-bold \u2014 so a stack led by a family the kit holds at one weight renders every other weight in that face, silently. Check the font stack against the kit's cached faces before concluding geometry is at fault. LOW ink with high sim means recorded marks are absent or painted invisibly. Do not regress PASS configs. ${mode === "files" ? "Update the files in your candidate directory and re-run the score." : "Reply with the complete corrected files in the same FILE format."}`;
 }
 function archivePriorRun(outDir) {
   if (!existsSync21(path27.join(outDir, "run-log.json")) && !existsSync21(path27.join(outDir, "loop-state.json"))) return void 0;
@@ -8493,7 +8702,7 @@ ${propLines.join("\n")}
 
 ${syntheticCombos.length > 0 ? `UNRECORDED REACHABLE COMBINATIONS: the design's exclusive axis cannot express ${syntheticCombos.join(", ")} \u2014 the API split makes them reachable with NO recorded truth. Compose them from the recorded per-axis truth (paint variables: one axis sets, the other consumes), never invent a bespoke look, and list them in your report.
 ` : ""}${slots.length > 0 ? `CONTENT PROPS: every string prop defaults to its RECORDED text \u2014 render the PROP, never a hardcoded literal. Configs pass per-pose recorded strings wherever the recording varies, and pixels enforce them: a hardcoded string fails those configs. Content presence (a heading that only exists in some poses) follows the AXIS props; the string prop only supplies the text. RICH-TEXT DEFAULTS: when the recorded content is a multi-run rich node (mixed weights, an underlined link span) whose concatenation is the prop's default string, a plain-string default would flatten the recorded formatting \u2014 default the parameter to undefined and render the recorded rich markup when the prop is absent; a caller-supplied string then renders plainly. That mirrors the design tool's own emission logic and keeps every recorded pose pixel-exact.
-` : ""}Rules: generated element ids come from React's useId() \u2014 never Math.random() in render/state init (SSR hydration hazard; measured: two same-day bundles disagreed). Plain CSS in styles.css (tokens.css optional, loaded first) \u2014 no Tailwind, no imports beyond react/react-dom, and NEVER import the stylesheet from the entry module: the harness injects tokens.css and styles.css itself, and an entry that imports CSS does not compile here (measured cost: one full round, every config 0). The component renders the RECORDED content as its defaults \u2014 reproduce it from the emissions. ${forcingCanon}${fontsLine}The host sizes nothing: the component is its natural recorded size. FLUIDITY AFFORDANCE (emit it always): every ROOT width declaration rides width: var(--tendril-root-width, <recorded>px) with that pose's recorded width as the fallback \u2014 per-variant root widths reuse the SAME property name with their own recorded fallbacks. With the property unset this is byte-equivalent truth: identical pixels, identical operability measurement (measured: flipping roots to a bare 100% held 20/20 pixels but made a commit check unmeasurable \u2014 the recorded pin carries real signal). A consumer makes an instance fluid by setting --tendril-root-width (e.g. 100%) on a wrapper, no edit to certified CSS. Widths only: recorded heights and internal geometry stay literal \u2014 fixed heights are often genuine design intent.`;
+` : ""}Rules: generated element ids come from React's useId() \u2014 never Math.random() in render/state init (SSR hydration hazard; measured: two same-day bundles disagreed). Plain CSS in styles.css (tokens.css optional, loaded first) \u2014 no Tailwind, no imports beyond react/react-dom, and NEVER import the stylesheet from the entry module: the harness injects tokens.css and styles.css itself, and an entry that imports CSS does not compile here (measured cost: one full round, every config 0). The component renders the RECORDED content as its defaults \u2014 reproduce it from the emissions. ${forcingCanon}${fontsLine}ROOT SIZE IS YOURS AND PIXELS DO NOT CHECK IT, IN EITHER DIRECTION: the mount floors your root to the recorded box (#root > *{min-width:<recorded w>px;min-height:<recorded h>px} \u2014 a floor, never a cap), and the image the scorer compares is a CROP of that box, so paint outside it is never compared at all. Measured through the real scorer against a correct 120x40 root: an UNDERSIZED 80x28 root and OVERSIZED 160x52 and 124x44 roots ALL scored sim 1.000 / ink 1.000 with a byte-identical crop, as long as internals stay literal and top-left anchored. An oversized root shows only when its own border, radius or shadow \u2014 or a re-centred internal layout \u2014 lands back inside the crop. And some roots are not floored at all: a non-replaced INLINE root (a bare <label>, or an <a href> for a link variant) ignores width/height/min-width/min-height entirely and renders content-sized whatever you declare. So take both root dimensions from the recorded box in the payload, and give the root a display that honours them \u2014 no score, passing or failing, is evidence they are right. FLUIDITY AFFORDANCE (emit it always): every ROOT width declaration rides width: var(--tendril-root-width, <recorded>px) with that pose's recorded width as the fallback \u2014 per-variant root widths reuse the SAME property name with their own recorded fallbacks. With the property unset this is byte-equivalent truth: identical pixels, identical operability measurement (measured: flipping roots to a bare 100% held 20/20 pixels but made a commit check unmeasurable \u2014 the recorded pin carries real signal). A consumer makes an instance fluid by setting --tendril-root-width (e.g. 100%) on a wrapper, no edit to certified CSS. Widths only: recorded heights and internal geometry stay literal \u2014 fixed heights are often genuine design intent.`;
   const mappedTokens = /* @__PURE__ */ new Set([...forcedStates, ...props.filter((p) => p.kind === "boolean").map((p) => p.name)]);
   const unmappedInteractionEvidence = interactionEvidence.filter((e) => {
     const sel = e.endsWith(" (selection axis)");
@@ -8891,7 +9100,7 @@ ALL prose instructions live ABOVE the task payload \u2014 the payload contains o
 
 ASSETS: inline the SVG assets you RENDER byte-verbatim, unchanged \u2014 never redraw or approximate an icon. Recorded assets that no scored config displays may be omitted. Two techniques reconcile that rule with reuse (both measured at 1.000): a glyph recorded once but shown in several colors keeps its bytes (fill attribute included) and is repainted with a CSS fill rule \u2014 a CSS declaration outranks an SVG presentation attribute, so one verbatim copy serves every tone; and multi-part glyphs needing fractional placement can nest each verbatim asset as a child <svg x= y=> inside one integer-origin frame (SVG user-space coordinates are exact), an alternative to the transform: scale() pattern.
 
-GEOMETRY ARBITRATION (when emission styling and the recorded box disagree, the BOX wins): Figma strokes are INSIDE the box \u2014 border+padding sums that overshoot a recorded dimension mean use an inset box-shadow or subtract the border from the padding. That rule covers strokes AT the box edge only: when a config's reference PNG is LARGER than its recorded box, the recording itself proves an OUTWARD effect \u2014 a hover ring, glow, or shadow past the frame \u2014 and the outward part is drawn outward (box-shadow spread, outline), never forced inside. On such configs the score report carries a "seat" field ({x, y} \u2014 where the recorded box sits inside the larger reference), derived from the recording's own effect geometry (shadow offset/radius/spread) \u2014 informational, so an offset shadow's asymmetric bleed is not misread as a registration error. Following strokes-inside against a padded reference contradicts the recorded pad and cost a measured five configs a full round. The harness mounts each config at its recorded box (width \xD7 height, floors not clamps); build to those dimensions, not to guessed viewports. Known rasterizer delta: Chrome often seats small text ONE PIXEL HIGHER than Figma in an identically sized box. Correct it with a PAINT-ONLY offset on those text runs \u2014 position: relative with top: 1px \u2014 never with padding or margin, which would grow the recorded box this same paragraph calls truth. TREAT IT AS A MEASUREMENT, NOT A RULE: measured cases are 12px/16px and 14px/20px needing the nudge and 14px/18px not, so font size alone does not predict it and neither does any formula we can currently defend. RULE ORDER when both could apply (run 7: a config sat 0.0004 under the bar AND showed uniform spread \u2014 the rules pointed opposite ways): read the DIFF FIRST; the uniform-spread stop-rule below OUTRANKS the try-it rule here. Only when the diff shows a shifted band: apply the nudge, re-score, and keep it only if it helped. Four measured signatures, so do not expect one: on one kit it drove ink recall to 1.000; on another ink was already 1.000 and only similarity moved (mean 0.961 \u2192 0.976, four configs from 0.003 above the bar to 0.028); on a third it REGRESSED a passing bundle from 9/9 to 3/9 configs and had to be reverted; on a fourth it made every FAILING config worse too (tinted in-section surfaces: ink dropped ~0.011 across all eight configs and pushed a passing one under the bar). It is a hypothesis to score, never a default \u2014 NEVER apply it to a bundle that already passes, and when the failing family's diff shows a uniform low-density spread across the glyph band rather than a shifted band, the cause is rasterization weight, not seating: the nudge cannot help and a heavier hypothesis has no recorded truth to justify it \u2014 report the honest sub-bar result instead. Design-token NAMES in the payload are Figma names \u2014 canonicalize to valid CSS idents (lowercase kebab, e.g. "Text/text-primary" \u2192 --text-text-primary) if you emit tokens.css; literal values are equally acceptable. NEVER invent a token to satisfy a lint finding: quality findings are advisory, and a recorded value the kit has no token for is CORRECT as a literal \u2014 a made-up token name corrupts the tokens file as a record of the kit.
+GEOMETRY ARBITRATION (when emission styling and the recorded box disagree, the BOX wins): Figma strokes are INSIDE the box \u2014 border+padding sums that overshoot a recorded dimension mean use an inset box-shadow or subtract the border from the padding. That rule covers strokes AT the box edge only: when a config's reference PNG is LARGER than its recorded box, the recording itself proves an OUTWARD effect \u2014 a hover ring, glow, or shadow past the frame \u2014 and the outward part is drawn outward (box-shadow spread, outline), never forced inside. On such configs the score report carries a "seat" field ({x, y} \u2014 where the recorded box sits inside the larger reference), derived from the recording's own effect geometry (shadow offset/radius/spread) \u2014 informational, so an offset shadow's asymmetric bleed is not misread as a registration error. Following strokes-inside against a padded reference contradicts the recorded pad and cost a measured five configs a full round. The harness mounts each config at its recorded box (width \xD7 height) and FLOORS your root to it, never caps it; build to those recorded dimensions, not to guessed viewports \u2014 the prescribed API below says what that floor hides. Known rasterizer delta: Chrome often seats small text ONE PIXEL HIGHER than Figma in an identically sized box. Correct it with a PAINT-ONLY offset on those text runs \u2014 position: relative with top: 1px \u2014 never with padding or margin, which would grow the recorded box this same paragraph calls truth. TREAT IT AS A MEASUREMENT, NOT A RULE: measured cases are 12px/16px and 14px/20px needing the nudge and 14px/18px not, so font size alone does not predict it and neither does any formula we can currently defend. RULE ORDER when both could apply (run 7: a config sat 0.0004 under the bar AND showed uniform spread \u2014 the rules pointed opposite ways): read the DIFF FIRST; the uniform-spread stop-rule below OUTRANKS the try-it rule here. Only when the diff shows a shifted band: apply the nudge, re-score, and keep it only if it helped. Four measured signatures, so do not expect one: on one kit it drove ink recall to 1.000; on another ink was already 1.000 and only similarity moved (mean 0.961 \u2192 0.976, four configs from 0.003 above the bar to 0.028); on a third it REGRESSED a passing bundle from 9/9 to 3/9 configs and had to be reverted; on a fourth it made every FAILING config worse too (tinted in-section surfaces: ink dropped ~0.011 across all eight configs and pushed a passing one under the bar). It is a hypothesis to score, never a default \u2014 NEVER apply it to a bundle that already passes, and when the failing family's diff shows a uniform low-density spread across the glyph band rather than a shifted band, the cause is rasterization weight, not seating: the nudge cannot help and a heavier hypothesis has no recorded truth to justify it \u2014 report the honest sub-bar result instead. Design-token NAMES in the payload are Figma names \u2014 canonicalize to valid CSS idents (lowercase kebab, e.g. "Text/text-primary" \u2192 --text-text-primary) if you emit tokens.css; literal values are equally acceptable. NEVER invent a token to satisfy a lint finding: quality findings are advisory, and a recorded value the kit has no token for is CORRECT as a literal \u2014 a made-up token name corrupts the tokens file as a record of the kit.
 
 RECORDED BOXES ARE TRUTH even when inconsistent: the same string may
 have different recorded widths across variants (designer resizing) \u2014 a
@@ -8908,13 +9117,13 @@ PAINT & PLATFORM TRAPS (each measured on a paid run; every one passed typecheck,
 - A native <dialog> carries user-agent padding: 1em. Override every side, or the root grows past its recorded box and every band inside shifts.
 - THE PAGE CANVAS IS NOT YOURS. Never paint the recording's page background into the component \u2014 no canvas-coloured plates across the root box, no square shadow spread carrying the canvas past the frame. The mount composites your render over the recorded canvas, so transparency wherever the recording shows canvas is both correct and scores correctly; the score report's canvasCoupling counts canvas pixels your render refuses to let the page repaint, and a component that paints the canvas is wrong on every real page.
 - TOKENS SCOPE TO YOUR ROOT CLASS, NEVER :root. Bundles compose on real pages: token names on :root collide across independently generated components and the last stylesheet loaded silently rewrites the others (measured: two colliding names flipped certified surfaces translucent). Declare every token under the component's root class.
-- WHEN TWO AXES BOTH CONTROL PAINT, THEY COMPOSE THROUGH CUSTOM PROPERTIES \u2014 one axis SETS variables, the other CONSUMES them. Direct paint rules on both axes have equal specificity, so source order silently drops one axis for exactly the crossed poses (measured: variant \xD7 tone \u2014 primary+critical rendered dark neutral instead of the recorded red; the sampled scorer never sees crossed poses, so nothing catches it but pixels in use).
+- WHEN TWO AXES BOTH CONTROL PAINT, THEY COMPOSE THROUGH CUSTOM PROPERTIES \u2014 one axis SETS variables, the other CONSUMES them. Direct paint rules on both axes have equal specificity, so source order silently drops one axis for exactly the crossed poses (measured: variant \xD7 tone \u2014 primary+critical rendered dark neutral instead of the recorded red). CROSSED POSES ARE SCORED: the harness mounts every RECORDED pose, crosses included \u2014 measured on a bundle passing 20/20 (13 single-axis configs, 7 crosses), adding one later same-specificity rule left every single-axis config the rule did not itself target byte-stable and dropped all five crossed configs it touched from ~0.99 to sim 0.09\u20130.16. Only a cross with NO recorded pose goes ungraded.
 
 INTERACTION-READY BY DEFAULT: components are real controls, never static lookalikes \u2014 use the native element matching the archetype (button, input[type=radio|checkbox], select\u2026), real handlers, keyboard operability, and real state (checked/disabled/:hover/:focus-visible). Behavioral checks fail statues. (The forcing-hook rule is specified once, in the prescribed API below.) Your file runs in a bare browser bundle: it must be fully self-contained. IMPORT EVERY React API you use explicitly \u2014 e.g. import { useState, useRef, useEffect } from "react" \u2014 nothing is provided globally; a missing import crashes the mount and every config scores 0.
 
 STATE SEMANTICS (prescribed \u2014 do not choose your own):
 - The component OWNS its interaction state, seeded from the prop. A selection/checked prop supplies the INITIAL value; user interaction updates internal state and must visibly commit without any parent re-render. A purely controlled component that ignores its own clicks fails the behavioral checks. Call an on\u2026Change callback when one is in the prescribed API, but never depend on it to update your own paint.
-- Read-only means operable but not committable: the control stays focusable and in the accessibility tree with aria-readonly="true", and cancels commit on both pointer and keyboard. Do NOT use pointer-events:none or disabled to fake it \u2014 both destroy focusability, and disabled means something different.
+- Read-only means operable but not committable: the control stays focusable and in the accessibility tree with aria-readonly="true", and cancels commit on both pointer and keyboard. Do NOT fake it with pointer-events:none or disabled. pointer-events:none removes only the POINTER path \u2014 the element stops being hit-tested, so clicks land on whatever is behind it \u2014 while Tab still reaches it and .focus() still lands: the control still takes focus and still commits from the KEYBOARD (measured in Chrome: Space checked a pointer-events:none checkbox). Of the two, ONLY disabled refuses focus, which is why reaching for pointer-events:none to make a pose unfocusable fails disabled-not-focusable with "disabled element took focus".
 - GEOMETRY FOLLOWS PROPS; ONLY PAINT FOLLOWS LIVE STATE. Per-variant sizing must key off the pose props the caller passed, never off live interaction state \u2014 otherwise clicking resizes the component (a recorded selected/unselected width difference is a designer artifact, not a consequence of selection). The scorer renders static poses and structurally cannot see this, so it is on you.
 
 ${systemApi}
@@ -10120,6 +10329,8 @@ __export(verify_exports, {
   foldConfigStatus: () => foldConfigStatus,
   interactionCoverage: () => interactionCoverage,
   occlusionReport: () => occlusionReport,
+  operabilityLine: () => operabilityLine,
+  operabilityReport: () => operabilityReport,
   resolveComposition: () => resolveComposition,
   runVerify: () => runVerify
 });
@@ -10134,6 +10345,43 @@ function interactionCoverage(behaviors) {
     operability: interaction.length > 0 && interaction.every((b) => b.pass) ? "verified" : "unverified"
   };
 }
+function operabilityReport(input) {
+  const { interactionChecks, interactionPassed, preludeChecks } = interactionCoverage(input.behaviors);
+  const prelude = ` The ${preludeChecks} behavior check(s) that did run are page-level prelude style hygiene, which says nothing about whether the component works.`;
+  if (interactionChecks === 0) {
+    const evidence = input.interactionEvidence;
+    if (evidence === void 0) {
+      return {
+        short: "nothing authored; recorded poses never derived",
+        unavailable: `no interaction behaviours were authored for this component, and this run never derived the recording's interactive poses \u2014 nothing about focus, typing, or keyboard operation was measured, and nothing here rules out a static lookalike.${prelude}`
+      };
+    }
+    if (evidence.length > 0) {
+      return {
+        short: "interactive poses recorded, none authored",
+        unavailable: `the recording PROVES interactive poses (${evidence.join(
+          ", "
+        )}) and ZERO interaction behaviours were authored to cover them \u2014 nothing about focus, typing, or keyboard operation was measured; this is an instrument failure, not a working component.${prelude}`
+      };
+    }
+    return { short: "no interactive poses recorded", unavailable: `${NO_INTERACTIVE_POSES}${prelude}` };
+  }
+  if (interactionPassed < interactionChecks) {
+    const failed = interactionChecks - interactionPassed;
+    return {
+      checks: interactionChecks,
+      passed: interactionPassed,
+      short: `${failed} of ${interactionChecks} interaction check(s) failed`,
+      unverified: `the interaction checks RAN and ${failed} of ${interactionChecks} failed (each named in the FAIL behavior rows) \u2014 this component WAS exercised and did not behave as the recording requires; unverified here means measured and wrong, not unmeasured.`
+    };
+  }
+  return { checks: interactionChecks, passed: interactionPassed };
+}
+function operabilityLine(state) {
+  if ("unavailable" in state) return `UNVERIFIED  operability \u2014 ${state.unavailable}`;
+  if ("unverified" in state) return `UNVERIFIED  operability \u2014 ${state.unverified}`;
+  return void 0;
+}
 function foldConfigStatus(s, failDemotions, substitutedFamilies) {
   const { exact: _exact, ...reported } = s;
   let status = tierOf(s, BARS2.cert);
@@ -10174,7 +10422,8 @@ function checkSummarySegments(input) {
   const composition = availability.unavailable !== void 0 ? `composition NOT CHECKED (${availability.short})` : `composition ${tally(input.structural)} structural, ${input.crops !== void 0 ? `${tally(input.crops)} crops` : "crops unavailable"} (roles: ${rolesSourceLabel(availability.roles)}${(availability.roles.narrowingAccepted ?? []).length > 0 ? `, ${(availability.roles.narrowingAccepted ?? []).length} narrowing(s) accepted: ${(availability.roles.narrowingAccepted ?? []).join(", ")}` : ""})`;
   const occ = occlusionReport(input.occlusion);
   const occlusion = "unavailable" in occ ? `occlusion not applicable (${NO_OVERLAY_DECLARED})` : `occlusion ${tally(input.occlusion)}`;
-  return ` \xB7 ${composition} \xB7 ${occlusion}`;
+  const operability = "short" in input.operability ? `operability UNVERIFIED (${input.operability.short})` : `operability ${input.operability.passed}/${input.operability.checks} interaction`;
+  return ` \xB7 ${operability} \xB7 ${composition} \xB7 ${occlusion}`;
 }
 function occlusionReport(occlusion) {
   if (occlusion.length === 0) {
@@ -10241,7 +10490,10 @@ function taskFromManifest(opts, manifest, setDir) {
     task,
     unmapped,
     adapterOnly,
-    interactionEvidence: authored?.api.interactionEvidence ?? [],
+    // Registry sets carry hand-declared behaviors and no derivation
+    // runs, so their evidence is UNKNOWN, not empty: an empty list is
+    // spent downstream as "the recording holds no interactive pose".
+    interactionEvidence: authored?.api.interactionEvidence,
     unmappedInteractionEvidence: authored?.api.unmappedInteractionEvidence ?? []
   };
 }
@@ -10271,7 +10523,7 @@ async function runVerify(opts) {
   }
   let task;
   let unmapped = [];
-  let interactionEvidence = [];
+  let interactionEvidence;
   let unmappedInteractionEvidence = [];
   let availability = ROLES_NOT_RESOLVED;
   if (opts.task !== void 0) {
@@ -10408,7 +10660,8 @@ async function runVerify(opts) {
   const certified = statuses.filter((s) => s.status === "certified").length;
   const occlusionFailures = occlusion.filter((o) => !o.pass);
   const coverage = interactionCoverage(behaviors);
-  const evidenceUnverified = interactionEvidence.length > 0 && coverage.interactionChecks === 0;
+  const operability = operabilityReport({ behaviors, interactionEvidence });
+  const evidenceUnverified = (interactionEvidence?.length ?? 0) > 0 && coverage.interactionChecks === 0;
   const okExceptDemotion = pixelFailures.length === 0 && behaviorFailures.length === 0 && structuralFailures.length === 0 && cropFailures.length === 0 && occlusionFailures.length === 0 && !evidenceUnverified;
   const certBlockedByAbsentInk = opts.bar === "cert" ? absentInkDemoted : [];
   const ok = okExceptDemotion && certBlockedByAbsentInk.length === 0;
@@ -10448,7 +10701,11 @@ async function runVerify(opts) {
       // read exactly like a verified one — measured, a statue and a real
       // control produced the same 6/6. The split is the honest form.
       ...coverage,
-      ...interactionEvidence.length > 0 ? { interactionEvidence } : {},
+      ...interactionEvidence !== void 0 && interactionEvidence.length > 0 ? { interactionEvidence } : {},
+      // The one-word verdict's CAUSE, in the channel that has no summary
+      // line to carry it. `operability` above keeps its key and values;
+      // this says which of its meanings the run actually produced.
+      operabilityCheck: operability,
       // Poses the recording proves interactive that no operability
       // check covers — pixel-verified only. The first cold kit shipped
       // pressed/focus this way with nothing in the report saying so.
@@ -10509,11 +10766,10 @@ async function runVerify(opts) {
       process.stdout.write(`UNAVAILABLE composition crops \u2014 ${regionsOut.unavailable}
 `);
     }
-    const ic = interactionCoverage(behaviors);
     process.stdout.write(
       `
 ${certified}/${statuses.length} certified \xB7 ${report.coverage.pass}/${statuses.length} \u2265 pass bar \xB7 behaviors ${behaviors.length - behaviorFailures.length}/${behaviors.length}${checkSummarySegments(
-        { availability, structural, crops, occlusion }
+        { availability, structural, crops, occlusion, operability }
       )}
 `
     );
@@ -10542,14 +10798,13 @@ ${certified}/${statuses.length} certified \xB7 ${report.coverage.pass}/${statuse
     }
     if (evidenceUnverified) {
       process.stdout.write(
-        `FAIL      interaction-evidence \u2014 the recording proves interactive poses (${interactionEvidence.join(", ")}) and ZERO interaction behaviors were verified. The authoring vocabulary did not map them; this is an instrument failure, not a verified component. Mappable today: ${[...INTERACTION_STATES, ...BOOLEAN_STATES].join("/")} \u2014 on an axis named State (checked/selected state axes are recorded as evidence but not yet authorable \u2014 widening is on the roadmap; this is not fixable from component code).
-`
-      );
-    } else if (ic.interactionChecks === 0) {
-      process.stdout.write(
-        `UNVERIFIED  operability \u2014 0 interaction checks were authored for this component; the behaviors above are page-level style hygiene. Nothing here says the component responds to a user.
+        `FAIL      interaction-evidence \u2014 the recording proves interactive poses (${(interactionEvidence ?? []).join(", ")}) and ZERO interaction behaviors were verified. The authoring vocabulary did not map them; this is an instrument failure, not a verified component. Mappable today: ${[...INTERACTION_STATES, ...BOOLEAN_STATES].join("/")} \u2014 on an axis named State (checked/selected state axes are recorded as evidence but not yet authorable \u2014 widening is on the roadmap; this is not fixable from component code).
 `
       );
+    } else {
+      const line = operabilityLine(operability);
+      if (line !== void 0) process.stdout.write(`${line}
+`);
     }
     if (unmappedInteractionEvidence.length > 0) {
       process.stdout.write(
@@ -10624,7 +10879,7 @@ ${certified}/${statuses.length} certified \xB7 ${report.coverage.pass}/${statuse
     process.exitCode = ExitCode.VerificationFailed;
   }
 }
-var BARS2, NO_ROLE_MANIFEST, ROLES_NOT_RESOLVED, UNSTAMPED_ROLES, NO_OVERLAY_DECLARED;
+var BARS2, NO_INTERACTIVE_POSES, NO_ROLE_MANIFEST, ROLES_NOT_RESOLVED, UNSTAMPED_ROLES, NO_OVERLAY_DECLARED;
 var init_verify = __esm({
   "packages/cli/src/commands/verify.ts"() {
     "use strict";
@@ -10641,6 +10896,7 @@ var init_verify = __esm({
       pass: { sim: 0.95, ink: 0.95 },
       cert: { sim: 0.97, ink: 0.95 }
     };
+    NO_INTERACTIVE_POSES = "no interactive poses recorded \u2014 nothing about focus, typing, or keyboard operation was measured; a component that is not a control passes this field.";
     NO_ROLE_MANIFEST = Object.freeze({
       short: "no role manifest",
       unavailable: "the recording set declares no role manifest \u2014 composition (structural + crop) was NEVER CHECKED; nothing here says the main renders the SHIPPED part modules rather than a pixel-identical re-implementation"
@@ -10666,7 +10922,7 @@ function resolveEngineTask(opts, callerCwd) {
   const asPath = path34.resolve(callerCwd, opts.taskOrSet);
   const isSet = existsSync27(path34.join(asPath, "recording-set.json"));
   const registry = TASKS[opts.taskOrSet];
-  if (registry !== void 0 && !isSet) return { task: registry, name: opts.taskOrSet, ref: opts.taskOrSet, disclosures: [], interactionEvidence: [] };
+  if (registry !== void 0 && !isSet) return { task: registry, name: opts.taskOrSet, ref: opts.taskOrSet, disclosures: [], interactionEvidence: void 0 };
   if (isSet) {
     try {
       const authored = authorTaskFromSet(asPath);
@@ -10880,6 +11136,9 @@ METRIC DEADBAND (read before iterating on near-misses): the scored similarity/in
     substitutedFamilies
   });
   appendScoreHistory(candidateDir, { event: "round-scored", bar: opts.bar, pass: obj[0], total, certified: certifiedReps.length, floor: obj[1], mean: obj[2] });
+  const coverage = interactionCoverage(behaviors);
+  const operability = operabilityReport({ behaviors, interactionEvidence });
+  const evidenceUnverified = (interactionEvidence?.length ?? 0) > 0 && coverage.interactionChecks === 0;
   emitData(
     opts,
     {
@@ -10893,7 +11152,14 @@ METRIC DEADBAND (read before iterating on near-misses): the scored similarity/in
       // The loop's oracle must say what verify says: without this an
       // MCP-driven agent literally cannot tell a hollow verdict (all
       // behaviour passes are prelude hygiene) from a verified one.
-      coverage: interactionCoverage(behaviors),
+      //
+      // `operability` alone is ONE WORD covering four different states,
+      // and this is the channel where run 15's miss happened: the agent
+      // driving the loop reads this JSON and nothing else. It gets the
+      // same sentence verify's report carries, from the same function —
+      // fixing verify's channel and not this one would have left the
+      // reader who actually acts on it exactly where they were.
+      coverage: { ...coverage, operabilityCheck: operability },
       parityCoverage,
       evidenceDir,
       bundleManifest: emitted.written[0],
@@ -10904,7 +11170,7 @@ METRIC DEADBAND (read before iterating on near-misses): the scored similarity/in
       // Run 11: generators read allPass:true and reported success on
       // bundles verify then FAILED on the interaction-evidence gate —
       // the oracle must say what verify will say, including this.
-      ...interactionEvidence.length > 0 && interactionCoverage(behaviors).interactionChecks === 0 ? { interactionEvidenceUnverified: true, verifyWillFail: "interaction-evidence \u2014 the recording proves interactive poses none of the authored behaviors cover; not fixable from component code; REPORT it, do not iterate on it" } : {},
+      ...evidenceUnverified ? { interactionEvidenceUnverified: true, verifyWillFail: "interaction-evidence \u2014 the recording proves interactive poses none of the authored behaviors cover; not fixable from component code; REPORT it, do not iterate on it" } : {},
       certification: { certified: certifiedReps.length, total: scores.length, bar: certBar, note: "tierOf on exact values + parity and absent-ink demotion; verify's composition checks can demote further" }
     },
     () => {
@@ -10915,12 +11181,12 @@ METRIC DEADBAND (read before iterating on near-misses): the scored similarity/in
       process.stdout.write(`
 ${obj[0]}/${total} \xB7 certified ${certifiedReps.length}/${total} \xB7 floor=${obj[1].toFixed(3)} \xB7 mean=${obj[2].toFixed(3)} \xB7 evidence: ${evidenceDir}
 `);
-      const ic = interactionCoverage(behaviors);
-      if (interactionEvidence.length > 0 && ic.interactionChecks === 0) {
-        process.stdout.write(`INSTRUMENT GAP \u2014 the recording proves interactive poses (${interactionEvidence.join(", ")}) and zero interaction behaviors were authored; verify WILL fail this bundle (interaction-evidence). Not fixable from component code \u2014 report it, do not iterate on it.
+      if (evidenceUnverified) {
+        process.stdout.write(`INSTRUMENT GAP \u2014 the recording proves interactive poses (${(interactionEvidence ?? []).join(", ")}) and zero interaction behaviors were authored; verify WILL fail this bundle (interaction-evidence). Not fixable from component code \u2014 report it, do not iterate on it.
 `);
-      } else if (ic.interactionChecks === 0) {
-        process.stdout.write(`UNVERIFIED operability \u2014 0 interaction checks; the behaviour passes above are page-level style hygiene
+      } else {
+        const line = operabilityLine(operability);
+        if (line !== void 0) process.stdout.write(`${line}
 `);
       }
     }
@@ -11171,7 +11437,7 @@ var init_server = __esm({
     TOOLS = [
       {
         name: "tendril_record_plan",
-        description: "ENTRY POINT for implementing/building a React component from a Figma design or figma.com URL \u2014 start the Tendril pipeline here (after loading the tendril skill, if installed). Plans a recording session: computes the rep queue (anchor + one-factor + conflict crosses) from the verbatim get_metadata response (pass its blocks via metadataParts \u2014 no file to write) and persists the set manifest. Resumes if the set already exists. The output may carry USER QUESTIONS \u2014 defaultsToConfirm (which pose is the component's default) or a multiple-component-sets error (which set to record): render them to a present user and apply the answers via `defaults` / `componentSet`; non-interactive runs follow each question's stated fallback. Recording cost is stated in figmaCallEstimate, never asked about \u2014 proceed with what the user provided.",
+        description: "ENTRY POINT for implementing/building a React component from a Figma design or figma.com URL \u2014 start the Tendril pipeline here (after loading the tendril skill, if installed). Plans a recording session: computes the rep queue (anchor + one-factor + conflict crosses) from the verbatim get_metadata response (pass its blocks via metadataParts \u2014 no file to write) and persists the set manifest. Resumes if the set already exists. The output may carry USER QUESTIONS \u2014 defaultsToConfirm (which pose is the component's default) or a multiple-component-sets error (which set to record): render them to a present user and apply the answers via `defaults` / `componentSet`; non-interactive runs follow each question's stated fallback. It may also carry `interactionStatesToConfirm` \u2014 the recording holds no hover/focus/pressed state, so nothing shows how the component behaves when someone uses it: say its `statement` and `designFix` in that SAME one message (the fix is a Figma variant, not code). It is a disclosure, not a gate \u2014 no answer is required and recording proceeds regardless. The output also carries `feasibilityCheck`: the call arithmetic for this queue plus the free `whoami` check that turns it into a verdict \u2014 complete that handshake BEFORE the first recording call, and surface the verdict to the user when the set does not fit their daily allowance.",
         schema: z12.object({
           setDir: str("recording set directory to create/resume"),
           component: str("component/system name"),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tendrilapp/cli",
-  "version": "0.1.24",
+  "version": "0.1.25",
   "description": "Figma design systems → verified React components. CLI ruler + MCP server.",
   "license": "SEE LICENSE IN LICENSE",
   "type": "module",