@tendrilapp/cli 0.1.24 → 0.1.26

package/dist/tendril.js

@@ -928,6 +928,74 @@ var init_plan = __esm({
   }
 });
 
+// packages/figma/src/recording/envelope-content.ts
+function envelopeParts(payload) {
+  const content = payload?.content;
+  if (!Array.isArray(content)) return null;
+  const blocks = content;
+  const text = blocks.map((b) => typeof b.text === "string" ? b.text : "").filter((t) => t !== "").join("\n");
+  const image = blocks.find((b) => b.type === "image" && typeof b.data === "string");
+  return image === void 0 ? { text } : { text, imageData: image.data };
+}
+function namedCause(text, table) {
+  return table.find((entry) => entry.pattern.test(text))?.cause;
+}
+function jsonObjectPayload(text) {
+  try {
+    const value = JSON.parse(text);
+    return typeof value === "object" && value !== null && !Array.isArray(value) ? value : null;
+  } catch {
+    return null;
+  }
+}
+function checkEnvelopeContent(tool, payload) {
+  const parts = envelopeParts(payload);
+  if (parts === null) return { ok: true };
+  const { text, imageData } = parts;
+  const serviceError = namedCause(text, SERVICE_ERROR_SIGNATURES);
+  if (serviceError !== void 0) return { ok: false, reason: serviceError };
+  const reject = (expected) => {
+    const hint = namedCause(text, FAILURE_HINTS);
+    return { ok: false, reason: hint === void 0 ? expected : `${hint} \u2014 ${expected}` };
+  };
+  switch (tool) {
+    case "get_metadata":
+    case "get_metadata_interior":
+      return NODE_MARKUP.test(text) ? { ok: true } : reject('no node markup in the response (a get_metadata response contains elements like <symbol id="\u2026"> or <frame id="\u2026">)');
+    case "get_design_context":
+      return CODE_DECLARATION.test(text) || ANY_MARKUP.test(text) ? { ok: true } : reject("no code emission or markup in the response (a get_design_context response contains a component's code, or node markup when the design is too large)");
+    case "get_variable_defs":
+      return jsonObjectPayload(text) === null ? reject("the response is not a JSON object of variable definitions") : { ok: true };
+    case "get_screenshot": {
+      if (imageData === void 0) return reject("no image block in the response (a get_screenshot envelope carries base64 PNG bytes)");
+      const png = checkPngPayload(imageData);
+      return png.ok ? { ok: true } : reject(png.reason);
+    }
+  }
+}
+var NODE_MARKUP, ANY_MARKUP, CODE_DECLARATION, SERVICE_ERROR_SIGNATURES, FAILURE_HINTS;
+var init_envelope_content = __esm({
+  "packages/figma/src/recording/envelope-content.ts"() {
+    "use strict";
+    init_provided_recording();
+    NODE_MARKUP = /<[A-Za-z][\w:.-]*(?:\s[^>]*)?\sid="[^"]+"/;
+    ANY_MARKUP = /<[A-Za-z][\w:.-]*(?:\s[^>]*)?\/?>/;
+    CODE_DECLARATION = /(?:^|\n)[ \t]*(?:const|let|var|function|class|export|import|type|interface|async|@)\b/;
+    SERVICE_ERROR_SIGNATURES = [
+      { pattern: /reached the .{0,60}tool call limit/i, cause: "the Figma MCP reported that the account's tool-call limit is exhausted" },
+      { pattern: /tool call limit for your/i, cause: "the Figma MCP reported that the account's tool-call limit is exhausted" },
+      { pattern: /upgrade your (?:seat|plan)/i, cause: "the Figma MCP returned an upgrade/quota notice" }
+    ];
+    FAILURE_HINTS = [
+      { pattern: /\brate[- ]limit/i, cause: "the response looks like a rate-limit error" },
+      { pattern: /\b(?:429|too many requests)\b/i, cause: "the response looks like a rate-limit error" },
+      { pattern: /\b(?:quota|billing|subscription|seat)\b/i, cause: "the response looks like a quota/plan notice" },
+      { pattern: /\b(?:unauthorized|forbidden|not authorized|access denied|401|403)\b/i, cause: "the response looks like an authorization error" },
+      { pattern: /\b(?:error|failed|failure|timed out|timeout)\b/i, cause: "the response looks like an error message" }
+    ];
+  }
+});
+
 // packages/figma/src/recording/session.ts
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import path from "node:path";
@@ -990,6 +1058,7 @@ function planSet(setDir, component, symbols, opts = {}) {
     version: 1,
     component,
     ...opts.sourceFrames !== void 0 ? { sourceFrames: opts.sourceFrames } : {},
+    ...opts.variantScope !== void 0 ? { variantScope: opts.variantScope } : {},
     ...opts.defaults !== void 0 && Object.keys(opts.defaults).length > 0 ? { defaults: opts.defaults } : {},
     ...(() => {
       const variants = symbols.map((s) => s.name).filter((n) => n.includes("="));
@@ -1036,10 +1105,14 @@ function ingestEnvelope(setDir, slug, tool, payload) {
   if (!RECORD_TOOLS.includes(tool)) {
     throw new Error(`unknown tool "${tool}" \u2014 expected one of ${RECORD_TOOLS.join(", ")}`);
   }
+  const content = checkEnvelopeContent(tool, payload);
+  if (!content.ok) {
+    throw new Error(`${slug}/${tool} was NOT recorded \u2014 ${content.reason}. ${REINGEST_GUIDANCE}`);
+  }
   const schema = tool === "get_screenshot" ? ImageEnvelopeSchema : TextEnvelopeSchema;
   const parsed = schema.safeParse(payload);
   if (!parsed.success) {
-    throw new Error(`${slug}/${tool}: envelope rejected at the boundary: ${parsed.error.issues[0]?.message ?? "invalid"}`);
+    throw new Error(`${slug}/${tool} was NOT recorded \u2014 envelope rejected at the boundary: ${parsed.error.issues[0]?.message ?? "invalid"}. ${REINGEST_GUIDANCE}`);
   }
   const file = containedPath(setDir, slug, `${tool}.json`);
   mkdirSync(path.dirname(file), { recursive: true });
@@ -1076,12 +1149,13 @@ function ingestAsset(setDir, slug, name, content) {
   mkdirSync(path.dirname(file), { recursive: true });
   writeFileSync(file, content);
 }
-var RECORD_TOOLS, INTERIOR_TOOL, REQUIRED_TOOLS, SessionManifestSchema, manifestPath, PROTOCOL_ORDER, byProtocolOrder;
+var RECORD_TOOLS, INTERIOR_TOOL, REQUIRED_TOOLS, SessionManifestSchema, manifestPath, PROTOCOL_ORDER, byProtocolOrder, REINGEST_GUIDANCE;
 var init_session = __esm({
   "packages/figma/src/recording/session.ts"() {
     "use strict";
     init_svg_safety();
     init_provided_recording();
+    init_envelope_content();
     init_plan();
     RECORD_TOOLS = ["get_design_context", "get_metadata", "get_screenshot", "get_variable_defs", "get_metadata_interior"];
     INTERIOR_TOOL = "get_metadata_interior";
@@ -1111,6 +1185,31 @@ var init_session = __esm({
        * domains: the API must cover the lattice even where only a subset
        * is recorded. */
       latticeNames: z4.array(z4.string()).optional(),
+      /**
+       * WHETHER `latticeNames` IS A DENOMINATOR AT ALL.
+       *
+       * The lattice is derived from the metadata handed to `record plan`,
+       * so when that metadata is a bare list of variant nodes the count is
+       * the SELECTION, not the component set. Field case (run 17): four
+       * node ids that were 2 of 5 columns of a 5×2 set. Planning them would
+       * have recorded a set silently missing three variants — and the
+       * plan's own cross-check would have passed, because it validates
+       * against the same metadata it was handed. Downstream that reads as
+       * `latticeConfigs: 4 / unrecordedConfigs: 0`: an affirmative COMPLETE
+       * claim over 40% of a missing axis, on the trust anchor's own
+       * coverage disclosure.
+       *
+       * The signal is whether the metadata carried ENCLOSING CONTEXT: a
+       * per-variant `get_metadata` returns the `<symbol>` as the root with
+       * no ancestor, while a page- or set-level call nests the variants
+       * under the named component set. "component-set" therefore means the
+       * planner saw the set's own children; "selection" means it saw what
+       * it was given and cannot know what else exists.
+       *
+       * Absent on sets planned before this field — treated as unknown, not
+       * as complete, because that is what it was.
+       */
+      variantScope: z4.enum(["component-set", "selection"]).optional(),
       /** Which planning mode produced this queue. Absent = planned before
        * the full-matrix default (i.e. sampled) — resume uses this to
        * top-up rather than silently perpetuating a sampled queue. */
@@ -1120,6 +1219,7 @@ var init_session = __esm({
     manifestPath = (setDir) => path.join(setDir, "recording-set.json");
     PROTOCOL_ORDER = ["get_metadata", "get_design_context", "get_screenshot", "get_variable_defs", "get_metadata_interior"];
     byProtocolOrder = (tools) => [...tools].sort((a, b) => PROTOCOL_ORDER.indexOf(a) - PROTOCOL_ORDER.indexOf(b));
+    REINGEST_GUIDANCE = "Nothing was written. Recording persists per rep and resumes from disk, so re-run the same command with the real response; if the Figma MCP reported a tool-call or rate limit, wait for the quota to reset first.";
   }
 });
 
@@ -1216,6 +1316,7 @@ var init_src = __esm({
     init_axis_defaults();
     init_plan();
     init_session();
+    init_envelope_content();
     init_roles();
   }
 });
@@ -1819,6 +1920,10 @@ function tendrilInvocation() {
 function tendrilCommand(args) {
   return `${tendrilInvocation()} ${args}`;
 }
+function quoteArg(value) {
+  if (/["`$\\]/.test(value)) throw new Error(`refusing to emit a shell argument containing quote/backslash/backtick/$: ${value}`);
+  return /[\s'*?[\]()&;|<>#~]/.test(value) ? `"${value}"` : value;
+}
 var NPX_INVOCATION, cached;
 var init_invocation = __esm({
   "packages/cli/src/invocation.ts"() {
@@ -3375,6 +3480,112 @@ var init_paths = __esm({
   }
 });
 
+// packages/verify/src/font-collection.ts
+function isCollection(bytes) {
+  return bytes.length >= 12 && new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength).getUint32(0) === TTC_TAG;
+}
+function nameTableStrings(view, bytes, nameOffset, nameLength) {
+  const out = /* @__PURE__ */ new Map();
+  if (nameOffset + 6 > bytes.length) return out;
+  const count = view.getUint16(nameOffset + 2);
+  const stringOffset = nameOffset + view.getUint16(nameOffset + 4);
+  for (let i = 0; i < count; i++) {
+    const rec = nameOffset + 6 + i * 12;
+    if (rec + 12 > bytes.length) break;
+    const platformId = view.getUint16(rec);
+    const encodingId = view.getUint16(rec + 2);
+    const nameId = view.getUint16(rec + 6);
+    const length = view.getUint16(rec + 8);
+    const offset = stringOffset + view.getUint16(rec + 10);
+    if (offset + length > bytes.length || offset + length > nameOffset + nameLength) continue;
+    const slice = bytes.subarray(offset, offset + length);
+    const isUtf16 = platformId === 3 || platformId === 0 || encodingId === 1;
+    let value = "";
+    if (isUtf16) {
+      for (let j = 0; j + 1 < slice.length; j += 2) value += String.fromCharCode(slice[j] << 8 | slice[j + 1]);
+    } else {
+      for (const b of slice) value += String.fromCharCode(b);
+    }
+    if (value !== "" && !out.has(nameId)) out.set(nameId, value);
+  }
+  return out;
+}
+function listCollectionFaces(bytes) {
+  if (!isCollection(bytes)) return [];
+  const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+  const numFonts = view.getUint32(8);
+  const faces = [];
+  for (let i = 0; i < numFonts; i++) {
+    const dirOffset = view.getUint32(12 + i * 4);
+    if (dirOffset + SFNT_HEADER_SIZE > bytes.length) continue;
+    const numTables = view.getUint16(dirOffset + 4);
+    let names = /* @__PURE__ */ new Map();
+    for (let t = 0; t < numTables; t++) {
+      const rec = dirOffset + SFNT_HEADER_SIZE + t * TABLE_RECORD_SIZE;
+      if (rec + TABLE_RECORD_SIZE > bytes.length) break;
+      const tag = String.fromCharCode(bytes[rec], bytes[rec + 1], bytes[rec + 2], bytes[rec + 3]);
+      if (tag !== "name") continue;
+      names = nameTableStrings(view, bytes, view.getUint32(rec + 8), view.getUint32(rec + 12));
+      break;
+    }
+    const family = names.get(1);
+    const subfamily = names.get(2);
+    faces.push({ index: i, ...family !== void 0 ? { family } : {}, ...subfamily !== void 0 ? { subfamily } : {} });
+  }
+  return faces;
+}
+function extractCollectionFace(bytes, index) {
+  if (!isCollection(bytes)) throw new Error("not a TrueType Collection");
+  const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+  const numFonts = view.getUint32(8);
+  if (index < 0 || index >= numFonts) throw new Error(`face index ${index} out of range \u2014 the collection holds ${numFonts}`);
+  const dirOffset = view.getUint32(12 + index * 4);
+  const numTables = view.getUint16(dirOffset + 4);
+  const records = [];
+  for (let t = 0; t < numTables; t++) {
+    const rec = dirOffset + SFNT_HEADER_SIZE + t * TABLE_RECORD_SIZE;
+    const checksum = view.getUint32(rec + 4);
+    const offset = view.getUint32(rec + 8);
+    const length = view.getUint32(rec + 12);
+    if (offset + length > bytes.length) throw new Error(`collection table ${t} runs past the end of the file`);
+    records.push({ tag: bytes.subarray(rec, rec + 4), checksum, data: bytes.subarray(offset, offset + length) });
+  }
+  const aligned = (n) => n + 3 & ~3;
+  const bodySize = records.reduce((sum, r) => sum + aligned(r.data.length), 0);
+  const out = new Uint8Array(SFNT_HEADER_SIZE + records.length * TABLE_RECORD_SIZE + bodySize);
+  const outView = new DataView(out.buffer);
+  outView.setUint32(0, view.getUint32(dirOffset));
+  outView.setUint16(4, records.length);
+  const pow2 = Math.floor(Math.log2(Math.max(1, records.length)));
+  outView.setUint16(6, 16 * 2 ** pow2);
+  outView.setUint16(8, pow2);
+  outView.setUint16(10, records.length * 16 - 16 * 2 ** pow2);
+  let cursor = SFNT_HEADER_SIZE + records.length * TABLE_RECORD_SIZE;
+  records.forEach((r, i) => {
+    const rec = SFNT_HEADER_SIZE + i * TABLE_RECORD_SIZE;
+    out.set(r.tag, rec);
+    outView.setUint32(rec + 4, r.checksum);
+    outView.setUint32(rec + 8, cursor);
+    outView.setUint32(rec + 12, r.data.length);
+    out.set(r.data, cursor);
+    cursor += aligned(r.data.length);
+  });
+  return out;
+}
+function facesForFamily(bytes, family) {
+  const want = family.toLowerCase().replace(/\s+/g, "");
+  return listCollectionFaces(bytes).filter((f) => (f.family ?? "").toLowerCase().replace(/\s+/g, "") === want);
+}
+var TTC_TAG, TABLE_RECORD_SIZE, SFNT_HEADER_SIZE;
+var init_font_collection = __esm({
+  "packages/verify/src/font-collection.ts"() {
+    "use strict";
+    TTC_TAG = 1953784678;
+    TABLE_RECORD_SIZE = 16;
+    SFNT_HEADER_SIZE = 12;
+  }
+});
+
 // packages/verify/src/font-resolve.ts
 import { createHash } from "node:crypto";
 import { existsSync as existsSync6, mkdirSync as mkdirSync2, readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "node:fs";
@@ -3463,18 +3674,33 @@ async function resolveFonts(family, weights, cacheDir = DEFAULT_FONT_CACHE) {
 `);
   return { resolved, failures };
 }
-function addLocalFont(family, weight, filePath, cacheDir = DEFAULT_FONT_CACHE) {
+function addLocalFont(family, weight, filePath, cacheDir = DEFAULT_FONT_CACHE, faceIndex) {
   const src = path10.resolve(filePath);
   if (!existsSync6(src)) throw new Error(`font file not found: ${src}`);
   const ext = path10.extname(src).toLowerCase();
-  if (![".woff2", ".woff", ".ttf", ".otf"].includes(ext)) {
-    throw new Error(`unsupported font file "${ext}" \u2014 use .woff2 (preferred), .woff, .ttf or .otf`);
+  if (![".woff2", ".woff", ".ttf", ".otf", ".ttc"].includes(ext)) {
+    throw new Error(`unsupported font file "${ext}" \u2014 use .woff2 (preferred), .woff, .ttf, .otf or .ttc`);
   }
-  const bytes = new Uint8Array(readFileSync3(src));
+  let bytes = new Uint8Array(readFileSync3(src));
   if (bytes.length === 0) throw new Error(`font file is empty: ${src}`);
+  let storedExt = ext;
+  if (isCollection(bytes)) {
+    const candidates = facesForFamily(bytes, family);
+    const chosen = faceIndex ?? (candidates.length === 1 ? candidates[0].index : void 0);
+    if (chosen === void 0) {
+      const all = listCollectionFaces(bytes);
+      const shown = (candidates.length > 0 ? candidates : all).map((f) => `  --face ${f.index}  ${f.family ?? "(unnamed)"}${f.subfamily !== void 0 ? ` ${f.subfamily}` : ""}`).join("\n");
+      throw new Error(
+        `${path10.basename(src)} is a collection of ${all.length} faces and ${candidates.length === 0 ? `none is named "${family}"` : `${candidates.length} match "${family}"`} \u2014 name the one you mean with --face <index>:
+${shown}`
+      );
+    }
+    bytes = new Uint8Array(extractCollectionFace(bytes, chosen));
+    storedExt = ".ttf";
+  }
   mkdirSync2(cacheDir, { recursive: true });
   const sha256 = createHash("sha256").update(bytes).digest("hex");
-  const file = path10.join(cacheDir, `${family.toLowerCase().replace(/\s+/g, "-")}-${weight}${ext}`);
+  const file = path10.join(cacheDir, `${family.toLowerCase().replace(/\s+/g, "-")}-${weight}${storedExt}`);
   writeFileSync3(file, bytes);
   const face = { family, weight, source: `local:${path10.basename(src)}`, sha256, file, license: "unknown" };
   const mPath = path10.join(cacheDir, "manifest.json");
@@ -3564,6 +3790,7 @@ var DEFAULT_FONT_CACHE, UA, FONT_LICENSES, GOOGLE_LICENSE_IDS, GOOGLE_FONT_FILE_
 var init_font_resolve = __esm({
   "packages/verify/src/font-resolve.ts"() {
     "use strict";
+    init_font_collection();
     DEFAULT_FONT_CACHE = fontCacheDir();
     UA = "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.87 Safari/537.36";
     FONT_LICENSES = ["OFL-1.1", "Apache-2.0", "UFL-1.0", "proprietary", "unknown"];
@@ -3740,7 +3967,7 @@ export function Button(props: {
   [key: string]: unknown; // MUST spread unknown props (incl. data-*) onto the root element
 })
 
-Rules: plain CSS in styles.css (tokens.css optional, loaded first) \u2014 no Tailwind, no imports beyond react/react-dom. disabled buttons are unfocusable; the spinner honors prefers-reduced-motion (animation: none under the media query). Interactive states are REAL (:hover, :focus-visible) AND statically forceable via the data-tendril-state attribute ("hover" | "focus-visible") spread onto the root; forced and real selectors must share one declaration block, e.g. :is(:hover, [data-tendril-state~="hover"]). The host sizes nothing: the button is its natural recorded size. Fonts: 'Inter' is provided. Inline all SVGs (loading spinner, icons).
+Rules: plain CSS in styles.css (tokens.css optional, loaded first) \u2014 no Tailwind, no imports beyond react/react-dom. disabled buttons are unfocusable; the spinner honors prefers-reduced-motion (animation: none under the media query). Interactive states are REAL (:hover, :focus-visible) AND statically forceable via the data-tendril-state attribute ("hover" | "focus-visible") spread onto the root; forced and real selectors must share one declaration block, e.g. :is(:hover, [data-tendril-state~="hover"]). ROOT SIZE IS YOURS AND PIXELS DO NOT CHECK IT, IN EITHER DIRECTION: the mount floors your root to the recorded box (#root > *{min-width:<recorded w>px;min-height:<recorded h>px} \u2014 a floor, never a cap) and the image the scorer compares is a CROP of that box. So a button that computes NARROWER or SHORTER is stretched back and captures byte-identically to a correct one (measured on a real <button>), and an oversized one shows only where its own border, radius or shadow lands back inside the crop. Take both root dimensions from the recorded box, never from a score. Fonts: 'Inter' is provided. Inline all SVGs (loading spinner, icons).
 
 BEHAVIORAL CONTRACT (machine-verified, gating): the root is a focusable <button> with cursor:pointer; real :hover visibly changes it; the loading spinner has a RUNNING CSS animation. Static lookalikes fail.`;
     COMBO_FIX = {
@@ -4082,15 +4309,30 @@ async function runSteps(page, spec, renderPose) {
         const verdict = await page.evaluate(
           `(() => {
             const needle = ${JSON.stringify(step.assertTextVisible)};
-            const els = [...document.querySelectorAll('#root *')];
-            const holders = els.filter((el) => [...el.childNodes].some((n) => n.nodeType === 3 && (n.textContent ?? '').includes(needle)));
-            if (holders.length === 0) return 'text not in the DOM at all';
-            for (const el of holders) {
+            // Attributes a user actually perceives, whether by eye or
+            // through assistive tech. Deliberately NOT every attribute:
+            // a data-* or a name= is a place to park a string, which is
+            // the dodge this check exists to catch.
+            const PERCEIVED = ['placeholder', 'alt', 'aria-label', 'title', 'value'];
+            const visible = (el) => {
               const r = el.getBoundingClientRect();
               const cs = getComputedStyle(el);
-              if (r.width > 0 && r.height > 0 && cs.visibility !== 'hidden' && cs.display !== 'none' && Number(cs.opacity) > 0) return true;
-            }
-            return 'text present but not visibly rendered (hidden/zero-size/transparent node)';
+              return r.width > 0 && r.height > 0 && cs.visibility !== 'hidden' && cs.display !== 'none' && Number(cs.opacity) > 0;
+            };
+            const els = [...document.querySelectorAll('#root *')];
+            const textHolders = els.filter((el) => [...el.childNodes].some((n) => n.nodeType === 3 && (n.textContent ?? '').includes(needle)));
+            for (const el of textHolders) if (visible(el)) return true;
+            const attrHolders = els.filter((el) =>
+              PERCEIVED.some((a) => {
+                // The LIVE value for form controls: React's defaultValue
+                // sets the property, and the attribute may never appear.
+                const v = a === 'value' && 'value' in el ? el.value : el.getAttribute(a);
+                return typeof v === 'string' && v.includes(needle);
+              }),
+            );
+            for (const el of attrHolders) if (visible(el)) return true;
+            if (textHolders.length === 0 && attrHolders.length === 0) return 'text not in the DOM at all, and not in a placeholder/alt/aria-label/title/value either';
+            return 'present but not visibly rendered (hidden/zero-size/transparent node)';
           })()`
         );
         if (verdict !== true) return { id: spec.id, pass: false, detail: `sentinel "${step.assertTextVisible}": ${String(verdict)}` };
@@ -4355,7 +4597,7 @@ function definedVars(tokensCss) {
   for (const m of tokensCss.matchAll(/(--[\w-]+)\s*:/g)) names.add(m[1]);
   return names;
 }
-function recordedTokenMapEmpty(setDir, reps) {
+function recordedTokenMapState(setDir, reps) {
   const readMap = (file) => {
     if (!existsSync10(file)) return void 0;
     try {
@@ -4366,15 +4608,15 @@ function recordedTokenMapEmpty(setDir, reps) {
     }
   };
   const setLevel = readMap(path15.join(setDir, "get_variable_defs.json"));
-  if (setLevel !== void 0) return Object.keys(setLevel).length === 0;
+  if (setLevel !== void 0) return Object.keys(setLevel).length === 0 ? "empty" : "populated";
   let recorded = false;
   for (const rep of reps) {
     const m = readMap(path15.join(setDir, rep, "get_variable_defs.json"));
     if (m === void 0) continue;
     recorded = true;
-    if (Object.keys(m).length > 0) return false;
+    if (Object.keys(m).length > 0) return "populated";
   }
-  return recorded;
+  return recorded ? "empty" : "never-recorded";
 }
 function scannable(css) {
   const blank = (m) => m.replace(/[^\n]/g, " ");
@@ -4426,7 +4668,7 @@ function fontStackFindings(sheets, coverage) {
         kind: "font-stack",
         file: sheet.file,
         line: stack.line,
-        message: `font-family ${stack.text} binds to '${family}', which the font kit provides at ${has} \u2014 CSS matches the FAMILY first and picks a weight only inside it (a later family is never consulted for a missing weight, and the prelude's font-synthesis: none rules out faux-bold), so text at weight ${list} ${renders}, silently. ` + (rescue !== void 0 ? `'${rescue}' in this same stack provides ${list}: list it first.` : `No family in this stack provides ${list} \u2014 if the recording shows ${unserved.length === 1 ? "that weight" : "those weights"}, run \`tendril fonts resolve "${family}" --weights ${unserved.join(" ")}\` and re-score.`) + " ADVISORY: quality feedback only \u2014 it never moves a score, a tier, or the verdict."
+        message: `font-family ${stack.text} binds to '${family}', which the font kit provides at ${has} \u2014 CSS matches the FAMILY first and picks a weight only inside it (a later family is never consulted for a missing weight, and the prelude's font-synthesis: none rules out faux-bold), so text at weight ${list} ${renders}, silently. ` + (rescue !== void 0 ? `'${rescue}' in this same stack provides ${list}: list it first.` : `No family in this stack provides ${list} \u2014 if the recording shows ${unserved.length === 1 ? "that weight" : "those weights"}, run \`tendril fonts resolve "${family}" --weights ${unserved.join(" ")}\` and re-score.`) + " ADVISORY: the finding gates nothing \u2014 but the wrong face changes pixels, and this fix alone took a measured run from 7 to 9 certified."
       });
     }
   }
@@ -4461,10 +4703,17 @@ async function checkBundleQuality(bundleDir, entry, set, fontManifest) {
     }
   }
   if (css !== "") {
-    const recordedEmpty = set !== void 0 && recordedTokenMapEmpty(set.dir, set.reps);
-    for (const v of (await runTokenLint(css, "styles.css", definedVars(tokensCss), recordedEmpty)).violations) {
+    const mapState = set === void 0 ? void 0 : recordedTokenMapState(set.dir, set.reps);
+    for (const v of (await runTokenLint(css, "styles.css", definedVars(tokensCss), mapState !== void 0 && mapState !== "populated")).violations) {
       findings.push({ kind: "token-lint", file: "styles.css", line: v.line, message: v.message });
     }
+    if (mapState === "never-recorded") {
+      findings.push({
+        kind: "token-lint",
+        file: "styles.css",
+        message: "the recording set has NO design-token map (no get_variable_defs envelope at set or rep level), so whether these literals have kit tokens is UNKNOWN, not answered \u2014 the brief's empty token table means 'never recorded', not 'this kit has none'. Record it with `record next` on the set (it asks for get_variable_defs once, at set level) and re-run to get real token guidance."
+      });
+    }
   }
   return { findings, tokensAbsent: tokensCss === void 0 && !/var\(\s*--/.test(css) };
 }
@@ -5444,6 +5693,7 @@ var init_src4 = __esm({
     init_tasks();
     init_prelude();
     init_mount_limits();
+    init_font_collection();
     init_font_faces();
     init_font_resolve();
     init_paths();
@@ -5695,6 +5945,15 @@ import { spawnSync } from "node:child_process";
 import { existsSync as existsSync18, readFileSync as readFileSync14, readdirSync as readdirSync3 } from "node:fs";
 import os4 from "node:os";
 import path23 from "node:path";
+function withDeadline(work, ms) {
+  return Promise.race([
+    work,
+    new Promise((_resolve, reject) => {
+      const timer = setTimeout(() => reject(new McpProbeTimeout(ms)), ms);
+      timer.unref?.();
+    })
+  ]);
+}
 async function runDoctorChecks(options) {
   const checks = [];
   const mcpUrl = options.mcpUrl ?? DEFAULT_MCP_URL;
@@ -5703,19 +5962,26 @@ async function runDoctorChecks(options) {
     ...options.fetchImpl ? { fetchImpl: options.fetchImpl } : {}
   });
   try {
-    const info = await client.initialize();
-    const tools = await client.listTools();
+    const info = await withDeadline(client.initialize(), MCP_PROBE_DEADLINE_MS);
+    const tools = await withDeadline(client.listTools(), MCP_PROBE_DEADLINE_MS);
     checks.push({
       name: "figma-desktop-mcp",
       ok: true,
-      detail: `${info.name} ${info.version} (protocol ${info.protocolVersion}), ${tools.length} tools: ${tools.map((t) => t.name).join(", ")}`
+      // WHOSE capability this tested. Run 16 read a green tick here as
+      // permission to start recording, and could not: the CLI reaches
+      // this server with its own localhost client, while the AGENT held
+      // no Figma MCP tools at all, and `record` is agent-driven with no
+      // CLI path. The operator wrote a 100-line MCP client in the first
+      // ten minutes of a paid run. A check consumed by one party about
+      // another party's capability has to say so out loud.
+      detail: `${info.name} ${info.version} (protocol ${info.protocolVersion}), ${tools.length} tools: ${tools.map((t) => t.name).join(", ")} \u2014 this is THIS CLI's own connection. It does NOT test whether your agent session holds Figma MCP tools, and recording needs the AGENT to make those calls: confirm with one real get_metadata call before planning.`
     });
   } catch (err) {
     checks.push({
       name: "figma-desktop-mcp",
       ok: false,
       detail: err instanceof Error ? err.message : String(err),
-      remediation: err instanceof McpUnavailableError ? "Open the Figma desktop app, sign in, then Figma menu \u2192 Preferences \u2192 Enable local MCP server (Dev or Full seat on a paid plan)." : "The server answered but the exchange failed \u2014 check the signed-in account's seat, then retry."
+      remediation: err instanceof McpUnavailableError ? "Open the Figma desktop app, sign in, then Figma menu \u2192 Preferences \u2192 Enable local MCP server (Dev or Full seat on a paid plan)." : err instanceof McpProbeTimeout ? "Quit and reopen the Figma desktop app, then re-run doctor. If it answers again, nothing else is wrong \u2014 the server was reachable but stalled." : "The server answered but the exchange failed \u2014 check the signed-in account's seat, then retry."
     });
   }
   const openrouterKey = resolveCredential("OPENROUTER_API_KEY");
@@ -5854,7 +6120,7 @@ async function runDoctor(flags) {
   });
   if (!report.ok) process.exit(1);
 }
-var DEFAULT_MCP_URL, DOCTOR_DESCRIPTION;
+var DEFAULT_MCP_URL, DOCTOR_DESCRIPTION, MCP_PROBE_DEADLINE_MS, McpProbeTimeout;
 var init_doctor = __esm({
   "packages/cli/src/commands/doctor.ts"() {
     "use strict";
@@ -5882,6 +6148,15 @@ var init_doctor = __esm({
       exitCodes: { 0: "healthy", 1: "one or more required checks failed" },
       examples: ["tendril doctor", "tendril doctor --json"]
     };
+    MCP_PROBE_DEADLINE_MS = 1e4;
+    McpProbeTimeout = class extends Error {
+      constructor(ms) {
+        super(
+          `the Figma MCP server accepted the connection but did not answer within ${ms / 1e3}s. It is reachable and not responding \u2014 usually a Figma desktop app that needs restarting (this state has been seen after an in-place app update).`
+        );
+        this.name = "McpProbeTimeout";
+      }
+    };
   }
 });
 
@@ -7250,10 +7525,12 @@ var init_activate = __esm({
 var record_exports = {};
 __export(record_exports, {
   instanceLeads: () => instanceLeads,
+  interactionDisclosure: () => interactionDisclosure,
   isFigmaAssetUrl: () => isFigmaAssetUrl,
   isLocalAssetUrl: () => isLocalAssetUrl,
   narrowedRoles: () => narrowedRoles,
   nextPayload: () => nextPayload,
+  recordsInteractionState: () => recordsInteractionState,
   runRecordAsset: () => runRecordAsset,
   runRecordFetch: () => runRecordFetch,
   runRecordFinish: () => runRecordFinish,
@@ -7267,6 +7544,26 @@ import { existsSync as existsSync20, mkdtempSync as mkdtempSync2, readFileSync a
 import os5 from "node:os";
 import path26 from "node:path";
 import { writeFileSync as writeFileSync9 } from "node:fs";
+function recordsInteractionState(reports) {
+  const evident = (s) => stateTokens(s).some((t) => INTERACTION_EVIDENCE_VALUES.has(t));
+  return reports.some((r) => evident(r.axis) || r.domain.some(evident));
+}
+function interactionDisclosure(component, reports) {
+  const recordedVariants = reports.map((r) => ({ axis: r.axis, values: r.domain }));
+  const variantSummary = recordedVariants.length === 0 ? "" : recordedVariants.length === 1 ? `${recordedVariants[0].axis} variants for ${andList(recordedVariants[0].values)}` : `variants for ${andList(recordedVariants.map((v) => `${v.axis} (${andList(v.values)})`))}`;
+  const has = recordedVariants.length > 0;
+  const statement = `Your ${component} component ${has ? `has ${variantSummary} \u2014 but none of them is a hover, focus or pressed state` : "has no variants at all, so none of it is a hover, focus or pressed state"}. Nothing in the recording shows how ${component} looks when someone hovers it, tabs to it, or is using it, so Tendril has no picture of those to check the build against. Tendril still builds controls as real, working controls \u2014 never a static lookalike \u2014 and, with no focus state recorded, it uses the browser's own focus indicator rather than inventing a focus ring. You do not need to answer this: recording carries on either way.`;
+  const designFix = `If ${component} should look different when it is focused or hovered, that change belongs in Figma rather than in the code: add a Focus (or Hover) variant to the ${component} component set, record it, and Tendril will match it exactly. If ${component} is not something people interact with, there is nothing to do.`;
+  return {
+    component,
+    recordedVariants,
+    variantSummary,
+    statement,
+    designFix,
+    instruction: "DISCLOSURE, not a question. Say `statement` and `designFix` to a present user at PLAN time, in the SAME message as defaultsToConfirm and every other plan-time question \u2014 one message per session, never one per component and never mid-generation. No answer is required and nothing blocks; proceed with recording whatever they say. State ONLY what `recordedVariants` contains: never infer from the component's NAME what kind of control it is. Non-interactive runs: put the statement in your report.",
+    blocking: false
+  };
+}
 function symbolsFromMetadataEnvelope(file, sourceFrame) {
   const env = JSON.parse(readFileSync16(file, "utf8"));
   const text = env.content.map((c) => c.text ?? "").join("\n");
@@ -7360,6 +7657,7 @@ function runRecordPlan(opts) {
     }
   }
   const setNames = [...new Set(symbols.map((s) => s.setName).filter((n) => n !== void 0))];
+  const variantScope = setNames.length > 0 ? "component-set" : "selection";
   if (opts.componentSet !== void 0) {
     const filtered = symbols.filter((s) => s.setName === opts.componentSet);
     if (filtered.length === 0) {
@@ -7417,11 +7715,54 @@ function runRecordPlan(opts) {
   if (metadataTruncated) {
     warn(opts, "get_metadata response appears TRUNCATED (unclosed structure) \u2014 the variant list below may be incomplete. Cross-check variantsFound against the variant count Figma shows for this component set; re-fetch the metadata if lower.");
   }
-  const { manifest, plan, resumed, toppedUp } = planSet(opts.setDir, opts.component, symbols, { ...Object.keys(defaults).length > 0 ? { defaults } : {}, ...opts.sample === true ? { sample: true } : {} });
+  const { manifest, plan, resumed, toppedUp } = planSet(opts.setDir, opts.component, symbols, {
+    ...Object.keys(defaults).length > 0 ? { defaults } : {},
+    ...opts.sample === true ? { sample: true } : {},
+    variantScope
+  });
   const defaultReports = reportAxisDefaults(symbols, Object.keys(defaults).length > 0 ? defaults : void 0);
   const toConfirm = resumed ? [] : defaultReports.filter((r) => (r.rule === "non-interaction" || r.rule === "frequency") && r.domain.length > 1);
-  const callLow = manifest.reps.length * 3;
-  const callHigh = manifest.reps.length * 4;
+  const interactionStatesToConfirm = recordsInteractionState(defaultReports) ? void 0 : interactionDisclosure(manifest.component, defaultReports);
+  const poses = manifest.reps.length;
+  const callLow = poses * FIGMA_CALLS_PER_REP;
+  const callHigh = poses * FIGMA_CALLS_PER_REP_WORST;
+  const posesRemaining = sessionStatus(opts.setDir).reps.filter((r) => r.missing.length > 0).length;
+  const callsNeeded = posesRemaining * FIGMA_CALLS_PER_REP;
+  const callSentence = posesRemaining === poses ? `${poses} poses \xD7 ${FIGMA_CALLS_PER_REP} calls per pose = ${callsNeeded} Figma calls` : `${posesRemaining} poses still to record \xD7 ${FIGMA_CALLS_PER_REP} calls per pose = ${callsNeeded} Figma calls (${poses - posesRemaining} of ${poses} already on disk)`;
+  const arithmetic = `${callSentence} (up to ${posesRemaining * FIGMA_CALLS_PER_REP_WORST} if screenshots or assets need a second fetch)`;
+  const multiDay = callsNeeded > MULTI_DAY_CALL_THRESHOLD;
+  const feasibilityCheck = {
+    arithmetic,
+    callsNeeded,
+    callsWorstCase: posesRemaining * FIGMA_CALLS_PER_REP_WORST,
+    posesToRecord: posesRemaining,
+    callsPerPose: FIGMA_CALLS_PER_REP,
+    instruction: "BEFORE the first recording call, IF your Figma server exposes a `whoami` tool, call it \u2014 it names the seat and plan and is EXEMPT from Figma's tool-call limits, so the check costs nothing and spends no quota. Read the daily tool-call allowance for that seat/plan and divide: callsNeeded \xF7 allowance = days this set needs. Tendril owns the multiplication above; the allowance is Figma's and theirs to change, so take it from whoami and never from memory. NOT EVERY TRANSPORT HAS IT: the remote Figma MCP server does; the local Dev Mode server exposes six tools and `whoami` is not among them (measured 2026-08-14). If yours does not, say so plainly, treat the allowance as UNKNOWN, and use limitHintIfWhoamiIsSilent below \u2014 which is unverified and dated, and must be shown as such. Do not report a guessed allowance as a checked one.",
+    surface: multiDay ? "This set exceeds every daily allowance we have heard of, so it CANNOT finish in one day. State the verdict to the user in plain numbers BEFORE recording anything and let them choose from `options` \u2014 do not start on the assumption it will fit." : "Say nothing about cost if the division fits inside one day's allowance \u2014 a set that comfortably fits is not worth the user's attention. Surface the verdict and `options` only when it does not fit.",
+    verdictTemplate: `${callSentence}. Your <seat> seat on <plan> allows <allowance>/day. This set needs about <days> day(s) at that rate.`,
+    options: [
+      {
+        id: "pace",
+        decidedBy: "user, and you can carry it out",
+        text: "Spread the recording across days, staying inside the daily allowance. Nothing is lost at a limit: the set persists after every pose and re-running the same command resumes from disk, so a rate limit costs waiting, never recorded work."
+      },
+      {
+        id: "sample",
+        // Sampling trades away lattice coverage, so it stays a human
+        // decision structurally, not by instruction: it exists only as
+        // a CLI flag and the MCP surface has no parameter for it.
+        decidedBy: "HUMAN ONLY \u2014 offer it, never choose it, and you cannot run it",
+        text: "Record a reduced pose set (anchor + one-factor sweeps + conflict crosses) instead of the full variant matrix. This buys calls with coverage \u2014 sampling is blind to multi-axis interactions and the report discloses the poses it skipped \u2014 so only the user may accept that trade. There is no tool parameter for it; the user runs it themselves in their own terminal, before any pose is recorded.",
+        userRuns: [`rm ${quoteArg(path26.join(opts.setDir, "recording-set.json"))}`, `${tendrilCommand(`record plan --set ${quoteArg(opts.setDir)} --component ${quoteArg(manifest.component)}`)} --sample`]
+      },
+      {
+        id: "larger-allowance",
+        decidedBy: "user",
+        text: "A seat or plan with a larger daily allowance, if their organisation allows it. Figma's terms, not ours \u2014 state it as an option, never as advice to spend money."
+      }
+    ],
+    limitHintIfWhoamiIsSilent: LIMIT_HINT
+  };
   emitData(
     opts,
     {
@@ -7433,15 +7774,30 @@ function runRecordPlan(opts) {
       // the one check that catches parse/transfer losses this pipeline
       // cannot detect from the envelope alone.
       variantsFound: symbols.length,
+      // WHAT variantsFound IS A COUNT OF. The comment above tells the
+      // reader to hold it against Figma's own variant count — a check
+      // run 17 proved an agent cannot perform, because it cannot see
+      // the user's screen. So the pipeline must say when the number is
+      // merely the selection it was handed.
+      variantScope,
+      ...variantScope === "selection" ? { variantCoverageUnknown: SELECTION_SCOPE_DISCLOSURE } : {},
       planMode: manifest.planMode ?? "sample",
       ...metadataTruncated ? { metadataTruncated: true } : {},
       ...toppedUp !== void 0 ? { toppedUp } : {},
       notRecorded: manifest.notRecorded ?? null,
-      figmaCallEstimate: { reps: manifest.reps.length, calls: `~${callLow}\u2013${callHigh}` },
+      // The whole-set ledger, numbers only — what recording this queue
+      // from nothing costs. What it costs FROM HERE, and what to do
+      // about it, is feasibilityCheck's job.
+      figmaCallEstimate: { reps: poses, callsPerRep: FIGMA_CALLS_PER_REP, calls: `~${callLow}\u2013${callHigh}`, callsMin: callLow, callsMax: callHigh },
+      // A sibling of defaultsToConfirm: a handshake the agent completes
+      // with the user before the queue costs anything, not a field to
+      // relay as duration.
+      feasibilityCheck,
       // Cold-start fix (run 7): the first instruction rides the plan
       // response, so record_next is never needed to begin — it exists
       // only for resuming.
       next: nextPayload(opts.setDir),
+      ...interactionStatesToConfirm !== void 0 ? { interactionStatesToConfirm } : {},
       ...toConfirm.length > 0 ? {
         defaultsToConfirm: {
           instruction: "HEURISTIC defaults: the designer named no literal Default and no override was given, so the code guessed the component's zero point \u2014 the pose an empty-props mount shows and the pose behaviour checks aim at. When a USER is present, ask each question below BEFORE recording; if they pick a different value, re-run this exact plan command with --default <Axis>=<Value> (allowed until the first envelope is ingested; frozen with the recording after). Non-interactive: proceed with the resolved values and state them in your report.",
@@ -7454,6 +7810,42 @@ function runRecordPlan(opts) {
       } : {}
     },
     () => {
+      const writeFeasibility = () => {
+        if (callsNeeded === 0) return;
+        process.stdout.write(`recording cost: ${arithmetic}
+`);
+        if (multiDay) {
+          process.stdout.write(`FEASIBILITY: ${callsNeeded} calls exceeds every daily Figma allowance we have heard of \u2014 this CANNOT finish in one day.
+`);
+          process.stdout.write(`  ask Figma whoami (free \u2014 exempt from tool-call limits) for this seat's daily allowance, divide ${callsNeeded} by it, and say how many DAYS this needs before recording
+`);
+          process.stdout.write(`  (a) pace it across days \u2014 the set persists after every pose, so a rate limit costs waiting, never recorded work
+`);
+          process.stdout.write(`  (b) record fewer poses \u2014 YOUR call, not an agent's: delete recording-set.json and re-plan with --sample (buys calls with coverage)
+`);
+          process.stdout.write(`  (c) a seat or plan with a larger daily allowance
+`);
+        } else {
+          process.stdout.write(`FEASIBILITY: check ${callsNeeded} against this seat's daily Figma allowance (ask whoami \u2014 it is free) before recording; it only needs raising if it does not fit
+`);
+        }
+      };
+      const writeInteraction = () => {
+        if (interactionStatesToConfirm === void 0) return;
+        const d = interactionStatesToConfirm;
+        process.stdout.write(
+          `CONFIRM   states: ${d.component} records no hover, focus or pressed state${d.recordedVariants.length > 0 ? ` \u2014 it has ${d.variantSummary}` : " (it has no variants at all)"}
+`
+        );
+        process.stdout.write(`  nothing in the recording shows how it looks when someone hovers it, tabs to it, or is using it
+`);
+        process.stdout.write(`  Tendril still builds controls as real controls \u2014 never a static lookalike \u2014 and uses the browser's own focus indicator instead of inventing a focus ring
+`);
+        process.stdout.write(`  want a focus ring of your own? add a Focus variant to the ${d.component} component set in Figma and record again \u2014 Tendril will match it exactly
+`);
+        process.stdout.write(`  nothing to answer \u2014 recording carries on either way
+`);
+      };
       if (resumed) {
         if (opts.sample === true && (manifest.planMode ?? "sample") === "full") {
           process.stdout.write("NOTE: --sample has no effect on a resumed full-matrix set \u2014 delete recording-set.json to re-plan sampled (partial coverage is a deliberate choice)\n");
@@ -7467,18 +7859,20 @@ function runRecordPlan(opts) {
           process.stdout.write(`resumed existing plan (${manifest.reps.length} reps, ${manifest.planMode ?? "sample"} mode) \u2014 delete recording-set.json to re-plan
 `);
         }
+        writeFeasibility();
+        writeInteraction();
         return;
       }
       for (const r of plan.reps) process.stdout.write(`planned ${r.slug.padEnd(24)} ${r.nodeId} (${r.tier})
 `);
       if (plan.notRecorded.length > 0) process.stdout.write(`not recorded (${plan.notRecorded.length}): disclosed in the manifest
 `);
-      process.stdout.write(`estimated recording cost: ~${callLow}\u2013${callHigh} Figma calls for ${manifest.reps.length} reps
-`);
+      writeFeasibility();
       for (const q2 of toConfirm) {
         process.stdout.write(`CONFIRM   ${q2.axis}: default resolved to "${q2.value}" by heuristic (${q2.rule}) \u2014 ask the user; change with --default before recording
 `);
       }
+      writeInteraction();
     }
   );
 }
@@ -7491,7 +7885,19 @@ function nextPayload(setDir) {
     const frameNode = Object.keys(manifest.sourceFrames ?? {})[0] ?? manifest.reps[0]?.nodeId ?? "";
     return { slug: "__set__", nodeId: frameNode, tool: "get_variable_defs", note: `SET-LEVEL: call get_variable_defs on the component frame and ingest with --rep __set__. ${ENVELOPE_HELP}`, progress };
   }
-  return instruction === null ? { complete: true, progress } : { ...instruction, note: `${instruction.note}. ${ENVELOPE_HELP}`, progress };
+  return instruction === null ? { complete: true, progress } : {
+    ...instruction,
+    note: `${instruction.note}. ${ENVELOPE_HELP}`,
+    // RESUME POINTER, NOT A WORK ASSIGNMENT. This is the globally
+    // first unrecorded rep, so under parallel recorders it hands the
+    // same rep to everyone: run 18 measured 8 of 10 ingests pointing
+    // a recorder at `anchor`, which was another agent's job. Correct
+    // for picking a set back up, wrong as a loop driver, and it was
+    // labelled as neither.
+    scope: "resume-pointer",
+    parallelWarning: "This is the first unrecorded rep in the WHOLE set, not your next one. If several recorders are working this set at once, ignore it and follow your own assigned rep list \u2014 otherwise every recorder converges on the same rep.",
+    progress
+  };
 }
 function runRecordNext(opts) {
   const payload = nextPayload(opts.setDir);
@@ -7632,6 +8038,14 @@ async function runRecordIngest(opts) {
         remediation: "Save the get_variable_defs response verbatim as a text envelope."
       });
     }
+    const content = checkEnvelopeContent("get_variable_defs", payload);
+    if (!content.ok) {
+      fail(opts, ExitCode.InputValidation, {
+        error: `set-level get_variable_defs was NOT recorded \u2014 ${content.reason}`,
+        code: "envelope-rejected",
+        remediation: REINGEST_GUIDANCE
+      });
+    }
     writeFileSync9(path26.join(opts.setDir, "get_variable_defs.json"), `${JSON.stringify(payload, null, 1)}
 `);
     emitData(opts, { ingested: "get_variable_defs", rep: "__set__", setLevel: true, next: nextPayload(opts.setDir) }, () => {
@@ -7656,7 +8070,7 @@ async function runRecordIngest(opts) {
     fail(opts, ExitCode.InputValidation, {
       error: err instanceof Error ? err.message : String(err),
       code: "envelope-rejected",
-      remediation: "The envelope failed boundary validation \u2014 record the tool response again, verbatim, and re-ingest."
+      remediation: "Fix what the error names, then re-run this exact command \u2014 recording resumes from disk, so nothing already recorded is lost."
     });
   }
 }
@@ -7891,7 +8305,7 @@ function runRecordFinish(opts) {
 `);
   }
 }
-var ENVELOPE_HELP, isAutoFetchAssetUrl, describeRoleLoss;
+var FIGMA_CALLS_PER_REP, FIGMA_CALLS_PER_REP_WORST, MULTI_DAY_CALL_THRESHOLD, SELECTION_SCOPE_DISCLOSURE, LIMIT_HINT, stateTokens, MAX_SPOKEN_VALUES, andList, ENVELOPE_HELP, isAutoFetchAssetUrl, describeRoleLoss;
 var init_record = __esm({
   "packages/cli/src/commands/record.ts"() {
     "use strict";
@@ -7901,6 +8315,26 @@ var init_record = __esm({
     init_output();
     init_entitlement();
     init_invocation();
+    FIGMA_CALLS_PER_REP = 3;
+    FIGMA_CALLS_PER_REP_WORST = 4;
+    MULTI_DAY_CALL_THRESHOLD = 600;
+    SELECTION_SCOPE_DISCLOSURE = "variantsFound counts the nodes you passed, NOT the component set: this metadata carried no enclosing set, so nothing here can tell whether the set holds more variants. Do NOT report the lattice as complete on this basis. To establish the real denominator, call get_metadata WITHOUT a nodeId (a page-level listing), find the component set these nodes sit under, and re-run plan against it \u2014 re-planning is free until the first envelope is ingested. If you proceed as-is, say plainly that coverage is unestablished.";
+    LIMIT_HINT = {
+      status: "UNVERIFIED \u2014 recorded 2026-08-14 from Figma's published documentation and one field report; Figma changes these at will.",
+      use: "Use ONLY if whoami states no allowance, and say it is unverified when you show it. The allowance whoami reports always wins.",
+      perDayByPlan: {
+        "Dev/Full seat, Professional": "~200 tool calls/day",
+        "Dev/Full seat, Organization or Enterprise": "~600 tool calls/day",
+        Starter: "~6 tool calls/month"
+      },
+      burst: "A per-minute ceiling is documented alongside the daily one, so parallel recorders can trip a limit long before the daily budget runs out."
+    };
+    stateTokens = (s) => s.toLowerCase().replace(/[^a-z0-9]+/g, "-").split("-").filter((t) => t !== "");
+    MAX_SPOKEN_VALUES = 6;
+    andList = (items) => {
+      const shown = items.length <= MAX_SPOKEN_VALUES ? items : [...items.slice(0, MAX_SPOKEN_VALUES), `${items.length - MAX_SPOKEN_VALUES} more`];
+      return shown.length <= 1 ? shown[0] ?? "" : `${shown.slice(0, -1).join(", ")} and ${shown[shown.length - 1]}`;
+    };
     ENVELOPE_HELP = `Envelope format: text tools save {"content":[{"type":"text","text":"<VERBATIM response text incl. any Currently-selected-nodes block>"}]}; get_screenshot: do NOT download the image yourself \u2014 pass its image_url to \`${tendrilCommand("record fetch")}\` (MCP: tendril_record_fetch), which pulls the bytes to disk directly. That keeps the pixel ground truth out of your context and costs one approval instead of a shell command per asset. Assets are asset-<first-8-hex-of-figma-uuid>.<ext>; their URLs appear as const declarations inside the design-context text and also expire.`;
     isAutoFetchAssetUrl = (url) => isFigmaAssetUrl(url) || isLocalAssetUrl(url);
     describeRoleLoss = (loss) => loss.kind === "main" ? `drops main "${loss.main}"` : `stops "${loss.part}" being a part of main "${loss.main}"`;
@@ -8129,7 +8563,7 @@ ${preludeLines.join("\n")}` : ""}${absentLines.length > 0 ? `
 MISSING FEATURES (absent-ink clusters \u2014 recorded marks your render leaves out or paints invisibly; GATING at the cert bar. Fix the named node's ink \u2014 a config carrying one cannot certify):
 ${absentLines.join("\n")}` : ""}
 
-Fix the FAIL configs (region coordinates are in the recorded screenshot's frame; ink<1 means recorded foreground pixels your render does not cover). Reading the pair: ink=1 with LOW sim means nothing is MISSING (do not chase missing ink) \u2014 the same pixels are being painted wrong, and there are TWO causes. GEOMETRY: wrong position/size/radius; the diff shows shifted edges and bands. WRONG TEXT WEIGHT OR FACE: the diff shows a uniform haze over glyph runs; CSS binds the font FAMILY before the weight, a later family in the stack is never consulted for a weight the first one lacks, and font-synthesis: none rules out faux-bold \u2014 so a stack led by a family the kit holds at one weight renders every other weight in that face, silently. Check the font stack against the kit's cached faces before concluding geometry is at fault. LOW ink with high sim means recorded marks are absent or painted invisibly. Do not regress PASS configs. ${mode === "files" ? "Update the files in your candidate directory and re-run the score." : "Reply with the complete corrected files in the same FILE format."}`;
+Fix the FAIL configs (region coordinates are in the recorded screenshot's frame; ink<1 means recorded foreground pixels your render does not cover). Reading the pair: ink credits a recorded pixel when ANY render ink lands within 1px of it, so ink=1 proves coverage \u2014 not presence, shape, or colour. A wrong-shaped mark over the right region, or a wrong-coloured one that is still ink, scores 1.000; and a recorded mark within ~30 channel-sum of the backdrop (#f6f6f6 on white is 27) is not ink at all, so it can be absent at ink 1.000 with no MISSING line. With ink=1 AND low sim, coverage held while pixels differ, so start with the TWO causes below \u2014 but never read ink=1 as "nothing is missing": confirm every faint or small recorded mark (hairlines, dividers, low-contrast controls) exists in your render. GEOMETRY: wrong position/size/radius; the diff shows shifted edges and bands. WRONG TEXT WEIGHT OR FACE: the diff shows a uniform haze over glyph runs; CSS binds the font FAMILY before the weight, a later family in the stack is never consulted for a weight the first one lacks, and font-synthesis: none rules out faux-bold \u2014 so a stack led by a family the kit holds at one weight renders every other weight in that face, silently. Check the font stack against the kit's cached faces before concluding geometry is at fault. LOW ink with high sim means recorded marks are absent or painted invisibly. Do not regress PASS configs. ${mode === "files" ? "Update the files in your candidate directory and re-run the score." : "Reply with the complete corrected files in the same FILE format."}`;
 }
 function archivePriorRun(outDir) {
   if (!existsSync21(path27.join(outDir, "run-log.json")) && !existsSync21(path27.join(outDir, "loop-state.json"))) return void 0;
@@ -8483,7 +8917,13 @@ function authorComponentApi(opts) {
   const provided = opts.fonts ?? [];
   const recorded = opts.recordedFonts ?? [];
   const unprovided = recorded.filter((r) => !provided.some((p) => p.toLowerCase() === r.toLowerCase()));
-  const fontsLine = (provided.length > 0 ? `Fonts provided by the harness: ${provided.map((f) => `'${f}'`).join(", ")}. ` : "") + (recorded.length > 0 ? `The recording's declared famil${recorded.length === 1 ? "y is" : "ies are"} ${recorded.map((f) => `'${f}'`).join(", ")}${unprovided.length > 0 ? ` \u2014 ${unprovided.map((f) => `'${f}'`).join(", ")} ${unprovided.length === 1 ? "is" : "are"} NOT provided: the mount will substitute a provided face, scoring reflects the recorded one, and the residual glyph delta is not closable from CSS \u2014 do not chase it` : ""}. ` : "");
+  const faceGaps = (opts.providedFaces ?? []).map((f) => {
+    const need = (opts.recordedFaces ?? []).find((r) => r.family.toLowerCase() === f.family.toLowerCase());
+    const missing = (need?.weights ?? []).filter((w) => !f.weights.includes(w));
+    return { family: f.family, has: f.weights, missing };
+  }).filter((f) => f.missing.length > 0);
+  const weightsLine = (opts.providedFaces ?? []).length > 0 ? `Weights the harness can actually serve: ${(opts.providedFaces ?? []).map((f) => `'${f.family}' (${[...f.weights].sort((a, b) => a - b).join(", ")})`).join("; ")}. ` + (faceGaps.length > 0 ? `WEIGHT GAP \u2014 ${faceGaps.map((g) => `'${g.family}' is recorded at ${g.missing.join(", ")} which the cache does NOT hold`).join("; ")}. CSS binds the FAMILY before the weight and font-synthesis: none blocks the fall-through, so text at a missing weight renders in a weight this family DOES have, silently and at full score-cost. Do not lead a font stack with a family that cannot serve the weight you are setting; put a family that has it first, or report the gap rather than chasing the difference as geometry. ` : "") : "";
+  const fontsLine = weightsLine + (provided.length > 0 ? `Fonts provided by the harness: ${provided.map((f) => `'${f}'`).join(", ")}. ` : "") + (recorded.length > 0 ? `The recording's declared famil${recorded.length === 1 ? "y is" : "ies are"} ${recorded.map((f) => `'${f}'`).join(", ")}${unprovided.length > 0 ? ` \u2014 ${unprovided.map((f) => `'${f}'`).join(", ")} ${unprovided.length === 1 ? "is" : "are"} NOT provided: the mount will substitute a provided face, scoring reflects the recorded one, and the residual glyph delta is not closable from CSS \u2014 do not chase it` : ""}. ` : "");
   const forcingCanon = forcedStates.length > 0 ? `Interactive states are REAL (:hover, :focus-visible) AND statically forceable via the data-tendril-state attribute (a DOCUMENTED token-list attribute; tokens: ${forcedStates.map((t) => `"${t}"`).join(" | ")}) spread onto the root; forced and real selectors must share ONE declaration block, e.g. :is(:hover, [data-tendril-state~="hover"]) \u2014 match with ~= so compound states ("hover selected") work. ` : "";
   const systemApi = `Prescribed API (the harness mounts exactly this; deviation scores 0):
 export function ${componentIdent}(props: {
@@ -8493,7 +8933,7 @@ ${propLines.join("\n")}
 
 ${syntheticCombos.length > 0 ? `UNRECORDED REACHABLE COMBINATIONS: the design's exclusive axis cannot express ${syntheticCombos.join(", ")} \u2014 the API split makes them reachable with NO recorded truth. Compose them from the recorded per-axis truth (paint variables: one axis sets, the other consumes), never invent a bespoke look, and list them in your report.
 ` : ""}${slots.length > 0 ? `CONTENT PROPS: every string prop defaults to its RECORDED text \u2014 render the PROP, never a hardcoded literal. Configs pass per-pose recorded strings wherever the recording varies, and pixels enforce them: a hardcoded string fails those configs. Content presence (a heading that only exists in some poses) follows the AXIS props; the string prop only supplies the text. RICH-TEXT DEFAULTS: when the recorded content is a multi-run rich node (mixed weights, an underlined link span) whose concatenation is the prop's default string, a plain-string default would flatten the recorded formatting \u2014 default the parameter to undefined and render the recorded rich markup when the prop is absent; a caller-supplied string then renders plainly. That mirrors the design tool's own emission logic and keeps every recorded pose pixel-exact.
-` : ""}Rules: generated element ids come from React's useId() \u2014 never Math.random() in render/state init (SSR hydration hazard; measured: two same-day bundles disagreed). Plain CSS in styles.css (tokens.css optional, loaded first) \u2014 no Tailwind, no imports beyond react/react-dom, and NEVER import the stylesheet from the entry module: the harness injects tokens.css and styles.css itself, and an entry that imports CSS does not compile here (measured cost: one full round, every config 0). The component renders the RECORDED content as its defaults \u2014 reproduce it from the emissions. ${forcingCanon}${fontsLine}The host sizes nothing: the component is its natural recorded size. FLUIDITY AFFORDANCE (emit it always): every ROOT width declaration rides width: var(--tendril-root-width, <recorded>px) with that pose's recorded width as the fallback \u2014 per-variant root widths reuse the SAME property name with their own recorded fallbacks. With the property unset this is byte-equivalent truth: identical pixels, identical operability measurement (measured: flipping roots to a bare 100% held 20/20 pixels but made a commit check unmeasurable \u2014 the recorded pin carries real signal). A consumer makes an instance fluid by setting --tendril-root-width (e.g. 100%) on a wrapper, no edit to certified CSS. Widths only: recorded heights and internal geometry stay literal \u2014 fixed heights are often genuine design intent.`;
+` : ""}Rules: generated element ids come from React's useId() \u2014 never Math.random() in render/state init (SSR hydration hazard; measured: two same-day bundles disagreed). Plain CSS in styles.css (tokens.css optional, loaded first) \u2014 no Tailwind, no imports beyond react/react-dom, and NEVER import the stylesheet from the entry module: the harness injects tokens.css and styles.css itself, and an entry that imports CSS does not compile here (measured cost: one full round, every config 0). The component renders the RECORDED content as its defaults \u2014 reproduce it from the emissions. ${forcingCanon}${fontsLine}ROOT SIZE IS YOURS AND PIXELS DO NOT CHECK IT, IN EITHER DIRECTION: the mount floors your root to the recorded box (#root > *{min-width:<recorded w>px;min-height:<recorded h>px} \u2014 a floor, never a cap), and the image the scorer compares is a CROP of that box, so paint outside it is never compared at all. Measured through the real scorer against a correct 120x40 root: an UNDERSIZED 80x28 root and OVERSIZED 160x52 and 124x44 roots ALL scored sim 1.000 / ink 1.000 with a byte-identical crop, as long as internals stay literal and top-left anchored. An oversized root shows only when its own border, radius or shadow \u2014 or a re-centred internal layout \u2014 lands back inside the crop. And some roots are not floored at all: a non-replaced INLINE root (a bare <label>, or an <a href> for a link variant) ignores width/height/min-width/min-height entirely and renders content-sized whatever you declare. So take both root dimensions from the recorded box in the payload, and give the root a display that honours them \u2014 no score, passing or failing, is evidence they are right. FLUIDITY AFFORDANCE (emit it always): every ROOT width declaration rides width: var(--tendril-root-width, <recorded>px) with that pose's recorded width as the fallback \u2014 per-variant root widths reuse the SAME property name with their own recorded fallbacks. With the property unset this is byte-equivalent truth: identical pixels, identical operability measurement (measured: flipping roots to a bare 100% held 20/20 pixels but made a commit check unmeasurable \u2014 the recorded pin carries real signal). A consumer makes an instance fluid by setting --tendril-root-width (e.g. 100%) on a wrapper, no edit to certified CSS. Widths only: recorded heights and internal geometry stay literal \u2014 fixed heights are often genuine design intent.`;
   const mappedTokens = /* @__PURE__ */ new Set([...forcedStates, ...props.filter((p) => p.kind === "boolean").map((p) => p.name)]);
   const unmappedInteractionEvidence = interactionEvidence.filter((e) => {
     const sel = e.endsWith(" (selection axis)");
@@ -8783,8 +9223,8 @@ function recordedTextSlots(setDir, repSlugs) {
 }
 function authorTaskFromSet(setDir, opts = {}) {
   if (opts.fonts === void 0) {
-    const resolved = resolvedFontFamilies().map((f) => f.family);
-    if (resolved.length > 0) opts = { ...opts, fonts: resolved };
+    const resolvedFaces = resolvedFontFamilies();
+    if (resolvedFaces.length > 0) opts = { ...opts, fonts: resolvedFaces.map((f) => f.family), providedFaces: resolvedFaces.map((f) => ({ family: f.family, weights: [...f.weights] })) };
   }
   const manifest = loadManifest(setDir);
   const poses = [];
@@ -8816,6 +9256,15 @@ function authorTaskFromSet(setDir, opts = {}) {
     poses,
     ...latticeNames !== void 0 ? { latticeNames } : {},
     ...opts.fonts !== void 0 ? { fonts: opts.fonts } : {},
+    ...opts.providedFaces !== void 0 ? { providedFaces: opts.providedFaces } : {},
+    ...(() => {
+      try {
+        const needs = recordedFontNeeds(setDir);
+        return needs.length > 0 ? { recordedFaces: needs } : {};
+      } catch {
+        return {};
+      }
+    })(),
     ...recordedFonts.length > 0 ? { recordedFonts } : {},
     ...Object.keys(defaults).length > 0 ? { defaults } : {},
     ...textSlots.length > 0 ? { textSlots } : {},
@@ -8891,7 +9340,7 @@ ALL prose instructions live ABOVE the task payload \u2014 the payload contains o
 
 ASSETS: inline the SVG assets you RENDER byte-verbatim, unchanged \u2014 never redraw or approximate an icon. Recorded assets that no scored config displays may be omitted. Two techniques reconcile that rule with reuse (both measured at 1.000): a glyph recorded once but shown in several colors keeps its bytes (fill attribute included) and is repainted with a CSS fill rule \u2014 a CSS declaration outranks an SVG presentation attribute, so one verbatim copy serves every tone; and multi-part glyphs needing fractional placement can nest each verbatim asset as a child <svg x= y=> inside one integer-origin frame (SVG user-space coordinates are exact), an alternative to the transform: scale() pattern.
 
-GEOMETRY ARBITRATION (when emission styling and the recorded box disagree, the BOX wins): Figma strokes are INSIDE the box \u2014 border+padding sums that overshoot a recorded dimension mean use an inset box-shadow or subtract the border from the padding. That rule covers strokes AT the box edge only: when a config's reference PNG is LARGER than its recorded box, the recording itself proves an OUTWARD effect \u2014 a hover ring, glow, or shadow past the frame \u2014 and the outward part is drawn outward (box-shadow spread, outline), never forced inside. On such configs the score report carries a "seat" field ({x, y} \u2014 where the recorded box sits inside the larger reference), derived from the recording's own effect geometry (shadow offset/radius/spread) \u2014 informational, so an offset shadow's asymmetric bleed is not misread as a registration error. Following strokes-inside against a padded reference contradicts the recorded pad and cost a measured five configs a full round. The harness mounts each config at its recorded box (width \xD7 height, floors not clamps); build to those dimensions, not to guessed viewports. Known rasterizer delta: Chrome often seats small text ONE PIXEL HIGHER than Figma in an identically sized box. Correct it with a PAINT-ONLY offset on those text runs \u2014 position: relative with top: 1px \u2014 never with padding or margin, which would grow the recorded box this same paragraph calls truth. TREAT IT AS A MEASUREMENT, NOT A RULE: measured cases are 12px/16px and 14px/20px needing the nudge and 14px/18px not, so font size alone does not predict it and neither does any formula we can currently defend. RULE ORDER when both could apply (run 7: a config sat 0.0004 under the bar AND showed uniform spread \u2014 the rules pointed opposite ways): read the DIFF FIRST; the uniform-spread stop-rule below OUTRANKS the try-it rule here. Only when the diff shows a shifted band: apply the nudge, re-score, and keep it only if it helped. Four measured signatures, so do not expect one: on one kit it drove ink recall to 1.000; on another ink was already 1.000 and only similarity moved (mean 0.961 \u2192 0.976, four configs from 0.003 above the bar to 0.028); on a third it REGRESSED a passing bundle from 9/9 to 3/9 configs and had to be reverted; on a fourth it made every FAILING config worse too (tinted in-section surfaces: ink dropped ~0.011 across all eight configs and pushed a passing one under the bar). It is a hypothesis to score, never a default \u2014 NEVER apply it to a bundle that already passes, and when the failing family's diff shows a uniform low-density spread across the glyph band rather than a shifted band, the cause is rasterization weight, not seating: the nudge cannot help and a heavier hypothesis has no recorded truth to justify it \u2014 report the honest sub-bar result instead. Design-token NAMES in the payload are Figma names \u2014 canonicalize to valid CSS idents (lowercase kebab, e.g. "Text/text-primary" \u2192 --text-text-primary) if you emit tokens.css; literal values are equally acceptable. NEVER invent a token to satisfy a lint finding: quality findings are advisory, and a recorded value the kit has no token for is CORRECT as a literal \u2014 a made-up token name corrupts the tokens file as a record of the kit.
+GEOMETRY ARBITRATION (when emission styling and the recorded box disagree, the BOX wins): Figma strokes are INSIDE the box \u2014 border+padding sums that overshoot a recorded dimension mean use an inset box-shadow or subtract the border from the padding. That rule covers strokes AT the box edge only: when a config's reference PNG is LARGER than its recorded box, the recording itself proves an OUTWARD effect \u2014 a hover ring, glow, or shadow past the frame \u2014 and the outward part is drawn outward (box-shadow spread, outline), never forced inside. On such configs the score report carries a "seat" field ({x, y} \u2014 where the recorded box sits inside the larger reference), derived from the recording's own effect geometry (shadow offset/radius/spread) \u2014 informational, so an offset shadow's asymmetric bleed is not misread as a registration error. Following strokes-inside against a padded reference contradicts the recorded pad and cost a measured five configs a full round. The harness mounts each config at its recorded box (width \xD7 height) and FLOORS your root to it, never caps it; build to those recorded dimensions, not to guessed viewports \u2014 the prescribed API below says what that floor hides. Known rasterizer delta: Chrome often seats small text ONE PIXEL HIGHER than Figma in an identically sized box. Correct it with a PAINT-ONLY offset on those text runs \u2014 position: relative with top: 1px \u2014 never with padding or margin, which would grow the recorded box this same paragraph calls truth. TREAT IT AS A MEASUREMENT, NOT A RULE: measured cases are 12px/16px and 14px/20px needing the nudge and 14px/18px not, so font size alone does not predict it and neither does any formula we can currently defend. RULE ORDER when both could apply (run 7: a config sat 0.0004 under the bar AND showed uniform spread \u2014 the rules pointed opposite ways): read the DIFF FIRST; the uniform-spread stop-rule below OUTRANKS the try-it rule here. Only when the diff shows a shifted band: apply the nudge, re-score, and keep it only if it helped. Four measured signatures, so do not expect one: on one kit it drove ink recall to 1.000; on another ink was already 1.000 and only similarity moved (mean 0.961 \u2192 0.976, four configs from 0.003 above the bar to 0.028); on a third it REGRESSED a passing bundle from 9/9 to 3/9 configs and had to be reverted; on a fourth it made every FAILING config worse too (tinted in-section surfaces: ink dropped ~0.011 across all eight configs and pushed a passing one under the bar). It is a hypothesis to score, never a default \u2014 NEVER apply it to a bundle that already passes, and when the failing family's diff shows a uniform low-density spread across the glyph band rather than a shifted band, the cause is rasterization weight, not seating: the nudge cannot help and a heavier hypothesis has no recorded truth to justify it \u2014 report the honest sub-bar result instead. Design-token NAMES in the payload are Figma names \u2014 canonicalize to valid CSS idents (lowercase kebab, e.g. "Text/text-primary" \u2192 --text-text-primary) if you emit tokens.css; literal values are equally acceptable. NEVER invent a token to satisfy a lint finding: quality findings are advisory, and a recorded value the kit has no token for is CORRECT as a literal \u2014 a made-up token name corrupts the tokens file as a record of the kit.
 
 RECORDED BOXES ARE TRUTH even when inconsistent: the same string may
 have different recorded widths across variants (designer resizing) \u2014 a
@@ -8908,13 +9357,13 @@ PAINT & PLATFORM TRAPS (each measured on a paid run; every one passed typecheck,
 - A native <dialog> carries user-agent padding: 1em. Override every side, or the root grows past its recorded box and every band inside shifts.
 - THE PAGE CANVAS IS NOT YOURS. Never paint the recording's page background into the component \u2014 no canvas-coloured plates across the root box, no square shadow spread carrying the canvas past the frame. The mount composites your render over the recorded canvas, so transparency wherever the recording shows canvas is both correct and scores correctly; the score report's canvasCoupling counts canvas pixels your render refuses to let the page repaint, and a component that paints the canvas is wrong on every real page.
 - TOKENS SCOPE TO YOUR ROOT CLASS, NEVER :root. Bundles compose on real pages: token names on :root collide across independently generated components and the last stylesheet loaded silently rewrites the others (measured: two colliding names flipped certified surfaces translucent). Declare every token under the component's root class.
-- WHEN TWO AXES BOTH CONTROL PAINT, THEY COMPOSE THROUGH CUSTOM PROPERTIES \u2014 one axis SETS variables, the other CONSUMES them. Direct paint rules on both axes have equal specificity, so source order silently drops one axis for exactly the crossed poses (measured: variant \xD7 tone \u2014 primary+critical rendered dark neutral instead of the recorded red; the sampled scorer never sees crossed poses, so nothing catches it but pixels in use).
+- WHEN TWO AXES BOTH CONTROL PAINT, THEY COMPOSE THROUGH CUSTOM PROPERTIES \u2014 one axis SETS variables, the other CONSUMES them. Direct paint rules on both axes have equal specificity, so source order silently drops one axis for exactly the crossed poses (measured: variant \xD7 tone \u2014 primary+critical rendered dark neutral instead of the recorded red). CROSSED POSES ARE SCORED: the harness mounts every RECORDED pose, crosses included \u2014 measured on a bundle passing 20/20 (13 single-axis configs, 7 crosses), adding one later same-specificity rule left every single-axis config the rule did not itself target byte-stable and dropped all five crossed configs it touched from ~0.99 to sim 0.09\u20130.16. Only a cross with NO recorded pose goes ungraded.
 
 INTERACTION-READY BY DEFAULT: components are real controls, never static lookalikes \u2014 use the native element matching the archetype (button, input[type=radio|checkbox], select\u2026), real handlers, keyboard operability, and real state (checked/disabled/:hover/:focus-visible). Behavioral checks fail statues. (The forcing-hook rule is specified once, in the prescribed API below.) Your file runs in a bare browser bundle: it must be fully self-contained. IMPORT EVERY React API you use explicitly \u2014 e.g. import { useState, useRef, useEffect } from "react" \u2014 nothing is provided globally; a missing import crashes the mount and every config scores 0.
 
 STATE SEMANTICS (prescribed \u2014 do not choose your own):
 - The component OWNS its interaction state, seeded from the prop. A selection/checked prop supplies the INITIAL value; user interaction updates internal state and must visibly commit without any parent re-render. A purely controlled component that ignores its own clicks fails the behavioral checks. Call an on\u2026Change callback when one is in the prescribed API, but never depend on it to update your own paint.
-- Read-only means operable but not committable: the control stays focusable and in the accessibility tree with aria-readonly="true", and cancels commit on both pointer and keyboard. Do NOT use pointer-events:none or disabled to fake it \u2014 both destroy focusability, and disabled means something different.
+- Read-only means operable but not committable: the control stays focusable and in the accessibility tree with aria-readonly="true", and cancels commit on both pointer and keyboard. Do NOT fake it with pointer-events:none or disabled. pointer-events:none removes only the POINTER path \u2014 the element stops being hit-tested, so clicks land on whatever is behind it \u2014 while Tab still reaches it and .focus() still lands: the control still takes focus and still commits from the KEYBOARD (measured in Chrome: Space checked a pointer-events:none checkbox). Of the two, ONLY disabled refuses focus, which is why reaching for pointer-events:none to make a pose unfocusable fails disabled-not-focusable with "disabled element took focus".
 - GEOMETRY FOLLOWS PROPS; ONLY PAINT FOLLOWS LIVE STATE. Per-variant sizing must key off the pose props the caller passed, never off live interaction state \u2014 otherwise clicking resizes the component (a recorded selected/unselected width difference is a designer artifact, not a consequence of selection). The scorer renders static poses and structurally cannot see this, so it is on you.
 
 ${systemApi}
@@ -9313,7 +9762,9 @@ function countLatticeSymbols(setDir) {
   const manifestFile = path30.join(setDir, "recording-set.json");
   if (existsSync24(manifestFile)) {
     try {
-      const lattice = JSON.parse(readFileSync20(manifestFile, "utf8")).latticeNames;
+      const stored = JSON.parse(readFileSync20(manifestFile, "utf8"));
+      if (stored.variantScope !== "component-set") return null;
+      const lattice = stored.latticeNames;
       if (lattice !== void 0 && lattice.length > 0) return lattice.length;
     } catch {
     }
@@ -9882,10 +10333,76 @@ var init_src7 = __esm({
   }
 });
 
+// packages/cli/src/font-guidance.ts
+import path31 from "node:path";
+function fontsUnprovenRemediation(setDir) {
+  const set = setDir === void 0 ? void 0 : path31.resolve(setDir);
+  if (set !== void 0) {
+    try {
+      const needs = recordedFontNeeds(set);
+      if (needs.length > 0) {
+        const families = needs.map((n) => `"${n.family}"`).join(", ");
+        return `Run \`${tendrilCommand(`fonts resolve --set ${set}`)}\` \u2014 the recording declares ${families}; faces land in ${DEFAULT_FONT_CACHE}.`;
+      }
+    } catch {
+    }
+  }
+  const target = set ?? "<recording-dir>";
+  return `Run \`${tendrilCommand(`fonts resolve --set ${target}`)}\` (or \`${tendrilCommand('fonts resolve "<Family>" --weights 400 500 600')}\`) to populate the font cache \u2014 the cache read is ${DEFAULT_FONT_CACHE}.`;
+}
+function taskFontFamilies(setDir) {
+  try {
+    const families = recordedFontFamilies(setDir);
+    return families.length > 0 ? families : null;
+  } catch {
+    return null;
+  }
+}
+function unprovisionedFamilies(setDir, cacheDir) {
+  const declared = taskFontFamilies(setDir);
+  if (declared === null) return [];
+  const provided = new Set(verifiedFontFamilies(cacheDir).map((f) => f.family.toLowerCase()));
+  return declared.filter((f) => !provided.has(f.toLowerCase()));
+}
+function unprovisionedFaces(setDir, cacheDir) {
+  return [
+    ...unprovisionedFamilies(setDir, cacheDir),
+    ...missingWeights(setDir, cacheDir).map((g) => {
+      const missing = g.declared.filter((w) => !g.provided.includes(w));
+      return `${g.family} (${missing.length === 1 ? "weight" : "weights"} ${missing.join(", ")})`;
+    })
+  ];
+}
+function missingWeights(setDir, cacheDir) {
+  let needs;
+  try {
+    needs = recordedFontNeeds(setDir, { pairedOnly: true });
+  } catch {
+    return [];
+  }
+  const provided = new Map(verifiedFontFamilies(cacheDir).map((f) => [f.family.toLowerCase(), f.weights]));
+  const gaps = [];
+  for (const n of needs) {
+    const have = provided.get(n.family.toLowerCase());
+    if (have === void 0) continue;
+    if (n.weights.some((w) => !have.includes(w))) gaps.push({ family: n.family, declared: n.weights, provided: have });
+  }
+  return gaps;
+}
+var init_font_guidance = __esm({
+  "packages/cli/src/font-guidance.ts"() {
+    "use strict";
+    init_src4();
+    init_src7();
+    init_invocation();
+  }
+});
+
 // packages/cli/src/commands/fonts.ts
 var fonts_exports = {};
 __export(fonts_exports, {
   DEFAULT_FONT_CACHE: () => DEFAULT_FONT_CACHE,
+  familyMismatch: () => familyMismatch,
   runFontsAdd: () => runFontsAdd,
   runFontsRequired: () => runFontsRequired,
   runFontsResolve: () => runFontsResolve,
@@ -9893,7 +10410,7 @@ __export(fonts_exports, {
   runFontsStatus: () => runFontsStatus
 });
 import { existsSync as existsSync25, readFileSync as readFileSync21 } from "node:fs";
-import path31 from "node:path";
+import path32 from "node:path";
 async function runFontsResolve(opts) {
   const result = await resolveFonts(opts.family, opts.weights, opts.cacheDir);
   emitData(opts, result, () => {
@@ -9908,7 +10425,7 @@ async function runFontsResolve(opts) {
   }
 }
 async function runFontsResolveSet(opts) {
-  const setDir = path31.resolve(process.env["INIT_CWD"] ?? process.cwd(), opts.set);
+  const setDir = path32.resolve(process.env["INIT_CWD"] ?? process.cwd(), opts.set);
   let needs = [];
   try {
     needs = recordedFontNeeds(setDir);
@@ -9981,7 +10498,7 @@ async function runFontsResolveSet(opts) {
   }
 }
 function runFontsStatus(opts) {
-  const manifestPath2 = path31.join(opts.cacheDir, "manifest.json");
+  const manifestPath2 = path32.join(opts.cacheDir, "manifest.json");
   if (!existsSync25(manifestPath2)) {
     fail(opts, ExitCode.FontsUnproven, {
       error: `no font cache at ${opts.cacheDir}`,
@@ -9990,7 +10507,7 @@ function runFontsStatus(opts) {
     });
   }
   const faces = JSON.parse(readFileSync21(manifestPath2, "utf8"));
-  const lockVerdicts = opts.lock !== void 0 ? checkFontLock(path31.resolve(opts.lock), opts.cacheDir) : null;
+  const lockVerdicts = opts.lock !== void 0 ? checkFontLock(path32.resolve(opts.lock), opts.cacheDir) : null;
   emitData(opts, { faces, lockVerdicts }, () => {
     for (const f of faces) process.stdout.write(`cached ${f.family} ${f.weight} (${f.sha256.slice(0, 12)}\u2026)
 `);
@@ -10013,10 +10530,45 @@ function runFontsRequired(opts) {
   });
   if (missing.length > 0) process.exit(ExitCode.FontsUnproven);
 }
+function editDistance(a, b) {
+  const prev = Array.from({ length: b.length + 1 }, (_, i) => i);
+  const row = new Array(b.length + 1).fill(0);
+  for (let i = 1; i <= a.length; i++) {
+    row[0] = i;
+    for (let j = 1; j <= b.length; j++) {
+      row[j] = Math.min(prev[j] + 1, row[j - 1] + 1, prev[j - 1] + (a[i - 1] === b[j - 1] ? 0 : 1));
+    }
+    for (let j = 0; j <= b.length; j++) prev[j] = row[j];
+  }
+  return prev[b.length];
+}
+function familyMismatch(family, declared) {
+  if (declared.length === 0) return void 0;
+  if (declared.some((d) => d.toLowerCase() === family.toLowerCase())) return void 0;
+  const ranked = declared.map((d) => ({ d, score: editDistance(family.toLowerCase(), d.toLowerCase()) })).sort((a, b) => a.score - b.score);
+  const best = ranked[0];
+  return best.score <= Math.max(3, Math.floor(family.length / 3)) ? { nearest: best.d } : {};
+}
 function runFontsAdd(opts) {
+  if (opts.set !== void 0) {
+    const declared = taskFontFamilies(path32.resolve(opts.set)) ?? [];
+    const mismatch = familyMismatch(opts.family, declared);
+    if (mismatch !== void 0) {
+      fail(opts, ExitCode.InputValidation, {
+        error: `the recording set does not declare a family named "${opts.family}" \u2014 it declares ${declared.map((d) => `"${d}"`).join(", ")}. Adding it under this name would cache a face the mount never matches, and scoring would keep refusing for the family that is still missing.`,
+        code: "font-family-not-declared",
+        remediation: mismatch.nearest !== void 0 ? `Did you mean "${mismatch.nearest}"? ${tendrilCommand(`fonts add "${mismatch.nearest}" ${opts.weight} ${opts.file} --set ${path32.resolve(opts.set)}`)}` : `Use one of the declared families exactly as the recording spells it, or drop --set to add a family this set does not declare.`
+      });
+    }
+  } else {
+    warn(
+      opts,
+      `family "${opts.family}" was NOT checked against a recording \u2014 pass --set <recording-dir> to have the spelling verified, since a face cached under a name the mount does not match leaves scoring refusing for a family that still looks provided`
+    );
+  }
   let face;
   try {
-    face = addLocalFont(opts.family, opts.weight, opts.file, opts.cacheDir);
+    face = addLocalFont(opts.family, opts.weight, opts.file, opts.cacheDir, opts.face);
   } catch (err) {
     fail(opts, ExitCode.InputValidation, {
       error: err instanceof Error ? err.message : String(err),
@@ -10039,71 +10591,7 @@ var init_fonts = __esm({
     init_src4();
     init_src7();
     init_output();
-    init_invocation();
-  }
-});
-
-// packages/cli/src/font-guidance.ts
-import path32 from "node:path";
-function fontsUnprovenRemediation(setDir) {
-  const set = setDir === void 0 ? void 0 : path32.resolve(setDir);
-  if (set !== void 0) {
-    try {
-      const needs = recordedFontNeeds(set);
-      if (needs.length > 0) {
-        const families = needs.map((n) => `"${n.family}"`).join(", ");
-        return `Run \`${tendrilCommand(`fonts resolve --set ${set}`)}\` \u2014 the recording declares ${families}; faces land in ${DEFAULT_FONT_CACHE}.`;
-      }
-    } catch {
-    }
-  }
-  const target = set ?? "<recording-dir>";
-  return `Run \`${tendrilCommand(`fonts resolve --set ${target}`)}\` (or \`${tendrilCommand('fonts resolve "<Family>" --weights 400 500 600')}\`) to populate the font cache \u2014 the cache read is ${DEFAULT_FONT_CACHE}.`;
-}
-function taskFontFamilies(setDir) {
-  try {
-    const families = recordedFontFamilies(setDir);
-    return families.length > 0 ? families : null;
-  } catch {
-    return null;
-  }
-}
-function unprovisionedFamilies(setDir, cacheDir) {
-  const declared = taskFontFamilies(setDir);
-  if (declared === null) return [];
-  const provided = new Set(verifiedFontFamilies(cacheDir).map((f) => f.family.toLowerCase()));
-  return declared.filter((f) => !provided.has(f.toLowerCase()));
-}
-function unprovisionedFaces(setDir, cacheDir) {
-  return [
-    ...unprovisionedFamilies(setDir, cacheDir),
-    ...missingWeights(setDir, cacheDir).map((g) => {
-      const missing = g.declared.filter((w) => !g.provided.includes(w));
-      return `${g.family} (${missing.length === 1 ? "weight" : "weights"} ${missing.join(", ")})`;
-    })
-  ];
-}
-function missingWeights(setDir, cacheDir) {
-  let needs;
-  try {
-    needs = recordedFontNeeds(setDir, { pairedOnly: true });
-  } catch {
-    return [];
-  }
-  const provided = new Map(verifiedFontFamilies(cacheDir).map((f) => [f.family.toLowerCase(), f.weights]));
-  const gaps = [];
-  for (const n of needs) {
-    const have = provided.get(n.family.toLowerCase());
-    if (have === void 0) continue;
-    if (n.weights.some((w) => !have.includes(w))) gaps.push({ family: n.family, declared: n.weights, provided: have });
-  }
-  return gaps;
-}
-var init_font_guidance = __esm({
-  "packages/cli/src/font-guidance.ts"() {
-    "use strict";
-    init_src4();
-    init_src7();
+    init_font_guidance();
     init_invocation();
   }
 });
@@ -10119,7 +10607,10 @@ __export(verify_exports, {
   failureTally: () => failureTally,
   foldConfigStatus: () => foldConfigStatus,
   interactionCoverage: () => interactionCoverage,
+  latticeCoverage: () => latticeCoverage,
   occlusionReport: () => occlusionReport,
+  operabilityLine: () => operabilityLine,
+  operabilityReport: () => operabilityReport,
   resolveComposition: () => resolveComposition,
   runVerify: () => runVerify
 });
@@ -10134,6 +10625,43 @@ function interactionCoverage(behaviors) {
     operability: interaction.length > 0 && interaction.every((b) => b.pass) ? "verified" : "unverified"
   };
 }
+function operabilityReport(input) {
+  const { interactionChecks, interactionPassed, preludeChecks } = interactionCoverage(input.behaviors);
+  const prelude = ` The ${preludeChecks} behavior check(s) that did run are page-level prelude style hygiene, which says nothing about whether the component works.`;
+  if (interactionChecks === 0) {
+    const evidence = input.interactionEvidence;
+    if (evidence === void 0) {
+      return {
+        short: "nothing authored; recorded poses never derived",
+        unavailable: `no interaction behaviours were authored for this component, and this run never derived the recording's interactive poses \u2014 nothing about focus, typing, or keyboard operation was measured, and nothing here rules out a static lookalike.${prelude}`
+      };
+    }
+    if (evidence.length > 0) {
+      return {
+        short: "interactive poses recorded, none authored",
+        unavailable: `the recording PROVES interactive poses (${evidence.join(
+          ", "
+        )}) and ZERO interaction behaviours were authored to cover them \u2014 nothing about focus, typing, or keyboard operation was measured; this is an instrument failure, not a working component.${prelude}`
+      };
+    }
+    return { short: "no interactive poses recorded", unavailable: `${NO_INTERACTIVE_POSES}${prelude}` };
+  }
+  if (interactionPassed < interactionChecks) {
+    const failed = interactionChecks - interactionPassed;
+    return {
+      checks: interactionChecks,
+      passed: interactionPassed,
+      short: `${failed} of ${interactionChecks} interaction check(s) failed`,
+      unverified: `the interaction checks RAN and ${failed} of ${interactionChecks} failed (each named in the FAIL behavior rows) \u2014 this component WAS exercised and did not behave as the recording requires; unverified here means measured and wrong, not unmeasured.`
+    };
+  }
+  return { checks: interactionChecks, passed: interactionPassed };
+}
+function operabilityLine(state) {
+  if ("unavailable" in state) return `UNVERIFIED  operability \u2014 ${state.unavailable}`;
+  if ("unverified" in state) return `UNVERIFIED  operability \u2014 ${state.unverified}`;
+  return void 0;
+}
 function foldConfigStatus(s, failDemotions, substitutedFamilies) {
   const { exact: _exact, ...reported } = s;
   let status = tierOf(s, BARS2.cert);
@@ -10174,7 +10702,23 @@ function checkSummarySegments(input) {
   const composition = availability.unavailable !== void 0 ? `composition NOT CHECKED (${availability.short})` : `composition ${tally(input.structural)} structural, ${input.crops !== void 0 ? `${tally(input.crops)} crops` : "crops unavailable"} (roles: ${rolesSourceLabel(availability.roles)}${(availability.roles.narrowingAccepted ?? []).length > 0 ? `, ${(availability.roles.narrowingAccepted ?? []).length} narrowing(s) accepted: ${(availability.roles.narrowingAccepted ?? []).join(", ")}` : ""})`;
   const occ = occlusionReport(input.occlusion);
   const occlusion = "unavailable" in occ ? `occlusion not applicable (${NO_OVERLAY_DECLARED})` : `occlusion ${tally(input.occlusion)}`;
-  return ` \xB7 ${composition} \xB7 ${occlusion}`;
+  const operability = "short" in input.operability ? `operability UNVERIFIED (${input.operability.short})` : `operability ${input.operability.passed}/${input.operability.checks} interaction`;
+  return ` \xB7 ${operability} \xB7 ${composition} \xB7 ${occlusion}`;
+}
+function latticeCoverage(setManifest, scoredConfigs) {
+  const lattice = setManifest.latticeNames?.length;
+  const established = setManifest.variantScope === "component-set";
+  const notRecorded = setManifest.notRecorded !== void 0 && setManifest.notRecorded !== "" ? { notRecorded: setManifest.notRecorded } : {};
+  if (lattice === void 0) return { latticeConfigs: null, ...notRecorded };
+  if (established) return { latticeConfigs: lattice, unrecordedConfigs: Math.max(0, lattice - scoredConfigs), ...notRecorded };
+  return {
+    latticeConfigs: null,
+    // The count is still worth reporting — it is just not a
+    // denominator, and the name has to stop implying that it is.
+    variantsPlanned: lattice,
+    latticeUnestablished: setManifest.variantScope === "selection" ? "the recording was planned from a node SELECTION, not from a component set \u2014 the plan counted the nodes it was handed and could not see whether the set holds more variants, so the number of unrecorded poses is UNKNOWN, not zero" : "this set was planned before variant scope was recorded, so whether its lattice came from a component set or from a handed-in selection was never established \u2014 the number of unrecorded poses is unknown, not zero",
+    ...notRecorded
+  };
 }
 function occlusionReport(occlusion) {
   if (occlusion.length === 0) {
@@ -10241,7 +10785,10 @@ function taskFromManifest(opts, manifest, setDir) {
     task,
     unmapped,
     adapterOnly,
-    interactionEvidence: authored?.api.interactionEvidence ?? [],
+    // Registry sets carry hand-declared behaviors and no derivation
+    // runs, so their evidence is UNKNOWN, not empty: an empty list is
+    // spent downstream as "the recording holds no interactive pose".
+    interactionEvidence: authored?.api.interactionEvidence,
     unmappedInteractionEvidence: authored?.api.unmappedInteractionEvidence ?? []
   };
 }
@@ -10271,7 +10818,7 @@ async function runVerify(opts) {
   }
   let task;
   let unmapped = [];
-  let interactionEvidence = [];
+  let interactionEvidence;
   let unmappedInteractionEvidence = [];
   let availability = ROLES_NOT_RESOLVED;
   if (opts.task !== void 0) {
@@ -10408,7 +10955,8 @@ async function runVerify(opts) {
   const certified = statuses.filter((s) => s.status === "certified").length;
   const occlusionFailures = occlusion.filter((o) => !o.pass);
   const coverage = interactionCoverage(behaviors);
-  const evidenceUnverified = interactionEvidence.length > 0 && coverage.interactionChecks === 0;
+  const operability = operabilityReport({ behaviors, interactionEvidence });
+  const evidenceUnverified = (interactionEvidence?.length ?? 0) > 0 && coverage.interactionChecks === 0;
   const okExceptDemotion = pixelFailures.length === 0 && behaviorFailures.length === 0 && structuralFailures.length === 0 && cropFailures.length === 0 && occlusionFailures.length === 0 && !evidenceUnverified;
   const certBlockedByAbsentInk = opts.bar === "cert" ? absentInkDemoted : [];
   const ok = okExceptDemotion && certBlockedByAbsentInk.length === 0;
@@ -10432,12 +10980,7 @@ async function runVerify(opts) {
       // itself — not only in a long-gone plan output.
       ...(() => {
         try {
-          const setManifest = loadManifest(task.set);
-          const lattice = setManifest.latticeNames?.length;
-          return {
-            ...lattice !== void 0 ? { latticeConfigs: lattice, unrecordedConfigs: Math.max(0, lattice - statuses.length) } : { latticeConfigs: null },
-            ...setManifest.notRecorded !== void 0 && setManifest.notRecorded !== "" ? { notRecorded: setManifest.notRecorded } : {}
-          };
+          return latticeCoverage(loadManifest(task.set), statuses.length);
         } catch {
           return { latticeConfigs: null };
         }
@@ -10448,7 +10991,11 @@ async function runVerify(opts) {
       // read exactly like a verified one — measured, a statue and a real
       // control produced the same 6/6. The split is the honest form.
       ...coverage,
-      ...interactionEvidence.length > 0 ? { interactionEvidence } : {},
+      ...interactionEvidence !== void 0 && interactionEvidence.length > 0 ? { interactionEvidence } : {},
+      // The one-word verdict's CAUSE, in the channel that has no summary
+      // line to carry it. `operability` above keeps its key and values;
+      // this says which of its meanings the run actually produced.
+      operabilityCheck: operability,
       // Poses the recording proves interactive that no operability
       // check covers — pixel-verified only. The first cold kit shipped
       // pressed/focus this way with nothing in the report saying so.
@@ -10509,11 +11056,10 @@ async function runVerify(opts) {
       process.stdout.write(`UNAVAILABLE composition crops \u2014 ${regionsOut.unavailable}
 `);
     }
-    const ic = interactionCoverage(behaviors);
     process.stdout.write(
       `
 ${certified}/${statuses.length} certified \xB7 ${report.coverage.pass}/${statuses.length} \u2265 pass bar \xB7 behaviors ${behaviors.length - behaviorFailures.length}/${behaviors.length}${checkSummarySegments(
-        { availability, structural, crops, occlusion }
+        { availability, structural, crops, occlusion, operability }
       )}
 `
     );
@@ -10542,14 +11088,13 @@ ${certified}/${statuses.length} certified \xB7 ${report.coverage.pass}/${statuse
     }
     if (evidenceUnverified) {
       process.stdout.write(
-        `FAIL      interaction-evidence \u2014 the recording proves interactive poses (${interactionEvidence.join(", ")}) and ZERO interaction behaviors were verified. The authoring vocabulary did not map them; this is an instrument failure, not a verified component. Mappable today: ${[...INTERACTION_STATES, ...BOOLEAN_STATES].join("/")} \u2014 on an axis named State (checked/selected state axes are recorded as evidence but not yet authorable \u2014 widening is on the roadmap; this is not fixable from component code).
-`
-      );
-    } else if (ic.interactionChecks === 0) {
-      process.stdout.write(
-        `UNVERIFIED  operability \u2014 0 interaction checks were authored for this component; the behaviors above are page-level style hygiene. Nothing here says the component responds to a user.
+        `FAIL      interaction-evidence \u2014 the recording proves interactive poses (${(interactionEvidence ?? []).join(", ")}) and ZERO interaction behaviors were verified. The authoring vocabulary did not map them; this is an instrument failure, not a verified component. Mappable today: ${[...INTERACTION_STATES, ...BOOLEAN_STATES].join("/")} \u2014 on an axis named State (checked/selected state axes are recorded as evidence but not yet authorable \u2014 widening is on the roadmap; this is not fixable from component code).
 `
       );
+    } else {
+      const line = operabilityLine(operability);
+      if (line !== void 0) process.stdout.write(`${line}
+`);
     }
     if (unmappedInteractionEvidence.length > 0) {
       process.stdout.write(
@@ -10624,7 +11169,7 @@ ${certified}/${statuses.length} certified \xB7 ${report.coverage.pass}/${statuse
     process.exitCode = ExitCode.VerificationFailed;
   }
 }
-var BARS2, NO_ROLE_MANIFEST, ROLES_NOT_RESOLVED, UNSTAMPED_ROLES, NO_OVERLAY_DECLARED;
+var BARS2, NO_INTERACTIVE_POSES, NO_ROLE_MANIFEST, ROLES_NOT_RESOLVED, UNSTAMPED_ROLES, NO_OVERLAY_DECLARED;
 var init_verify = __esm({
   "packages/cli/src/commands/verify.ts"() {
     "use strict";
@@ -10641,6 +11186,7 @@ var init_verify = __esm({
       pass: { sim: 0.95, ink: 0.95 },
       cert: { sim: 0.97, ink: 0.95 }
     };
+    NO_INTERACTIVE_POSES = "no interactive poses recorded \u2014 nothing about focus, typing, or keyboard operation was measured; a component that is not a control passes this field.";
     NO_ROLE_MANIFEST = Object.freeze({
       short: "no role manifest",
       unavailable: "the recording set declares no role manifest \u2014 composition (structural + crop) was NEVER CHECKED; nothing here says the main renders the SHIPPED part modules rather than a pixel-identical re-implementation"
@@ -10666,7 +11212,7 @@ function resolveEngineTask(opts, callerCwd) {
   const asPath = path34.resolve(callerCwd, opts.taskOrSet);
   const isSet = existsSync27(path34.join(asPath, "recording-set.json"));
   const registry = TASKS[opts.taskOrSet];
-  if (registry !== void 0 && !isSet) return { task: registry, name: opts.taskOrSet, ref: opts.taskOrSet, disclosures: [], interactionEvidence: [] };
+  if (registry !== void 0 && !isSet) return { task: registry, name: opts.taskOrSet, ref: opts.taskOrSet, disclosures: [], interactionEvidence: void 0 };
   if (isSet) {
     try {
       const authored = authorTaskFromSet(asPath);
@@ -10735,6 +11281,7 @@ ${notRecorded}` : "";
 === TASK PAYLOAD (recorded truth, verbatim) ===
 ${segments}`;
   const payloadFile = path34.resolve(callerCwd, opts.out ?? `tendril-out/${name}-brief.md`);
+  const candidateDirSuggestion = path34.resolve(callerCwd, `tendril-out/${name}-candidate`);
   mkdirSync8(path34.dirname(payloadFile), { recursive: true });
   writeFileSync12(payloadFile, payload);
   emitData(
@@ -10763,8 +11310,16 @@ ${segments}`;
       protocol: [
         "Settle the proposer model (see modelSelection \u2014 ask the user when one is present), then:",
         `Read ${payloadFile} completely \u2014 it is the system brief plus every recorded config's emission, box, and assets.`,
-        `Write the complete bundle files (${task.entry}, styles.css, optional tokens.css) into a candidate directory.`,
-        `Run \`${tendrilCommand(`engine score ${ref} <candidateDir> --bar ${opts.bar} --model ${opts.model ?? "<declared-model>"} --json`)}\` \u2014 the CLI is the sole judge, and it refuses to score an undeclared model.`,
+        `Write the complete bundle files (${task.entry}, styles.css, optional tokens.css) into ${quoteArg(candidateDirSuggestion)} (create it with a bare \`mkdir -p\`), or into another directory if you were handed one.`,
+        // Both paths quoted, and the candidate directory NAMED rather
+        // than left as `<candidateDir>`: run 18 worked in a folder
+        // called "Test 2", where the unquoted form split into two
+        // arguments, and a placeholder is the other half of the same
+        // defect — a command the reader has to finish is one they can
+        // finish wrongly.
+        `Run \`${tendrilCommand(
+          `engine score ${quoteArg(ref)} ${quoteArg(candidateDirSuggestion)} --bar ${opts.bar} --model ${opts.model ?? "<declared-model>"} --json`
+        )}\` \u2014 the CLI is the sole judge, and it refuses to score an undeclared model. If you wrote the bundle elsewhere, pass that directory instead.`,
         "Apply the returned feedback and re-score. Stop when all checks pass or two consecutive scores fail to improve.",
         "Never edit recording sets; never claim scores yourself \u2014 only the score command's output counts."
       ]
@@ -10880,12 +11435,29 @@ METRIC DEADBAND (read before iterating on near-misses): the scored similarity/in
     substitutedFamilies
   });
   appendScoreHistory(candidateDir, { event: "round-scored", bar: opts.bar, pass: obj[0], total, certified: certifiedReps.length, floor: obj[1], mean: obj[2] });
+  const coverage = interactionCoverage(behaviors);
+  const operability = operabilityReport({ behaviors, interactionEvidence });
+  const evidenceUnverified = (interactionEvidence?.length ?? 0) > 0 && coverage.interactionChecks === 0;
   emitData(
     opts,
     {
       task: name,
       bar: opts.bar,
-      objective: { passCount: obj[0], total, floor: obj[1], mean: obj[2] },
+      // `total` is pixel configs PLUS behaviour checks, and nothing said
+      // so: run 18's operator relayed "6/16" for two rounds without
+      // knowing it meant ZERO configs passing — materially worse than it
+      // sounds, and the number a human decides whether to keep paying on.
+      objective: {
+        passCount: obj[0],
+        total,
+        pixelConfigs: scores.length,
+        pixelConfigsPassing: scores.filter((s) => s.pass).length,
+        behaviorChecks: behaviors.length,
+        behaviorChecksPassing: behaviors.filter((b) => b.pass).length,
+        note: `passCount/total counts ${scores.length} pixel config(s) AND ${behaviors.length} behaviour check(s) together \u2014 read pixelConfigsPassing to see how many CONFIGS pass`,
+        floor: obj[1],
+        mean: obj[2]
+      },
       scores,
       behaviors,
       feedback,
@@ -10893,7 +11465,14 @@ METRIC DEADBAND (read before iterating on near-misses): the scored similarity/in
       // The loop's oracle must say what verify says: without this an
       // MCP-driven agent literally cannot tell a hollow verdict (all
       // behaviour passes are prelude hygiene) from a verified one.
-      coverage: interactionCoverage(behaviors),
+      //
+      // `operability` alone is ONE WORD covering four different states,
+      // and this is the channel where run 15's miss happened: the agent
+      // driving the loop reads this JSON and nothing else. It gets the
+      // same sentence verify's report carries, from the same function —
+      // fixing verify's channel and not this one would have left the
+      // reader who actually acts on it exactly where they were.
+      coverage: { ...coverage, operabilityCheck: operability },
       parityCoverage,
       evidenceDir,
       bundleManifest: emitted.written[0],
@@ -10904,7 +11483,7 @@ METRIC DEADBAND (read before iterating on near-misses): the scored similarity/in
       // Run 11: generators read allPass:true and reported success on
       // bundles verify then FAILED on the interaction-evidence gate —
       // the oracle must say what verify will say, including this.
-      ...interactionEvidence.length > 0 && interactionCoverage(behaviors).interactionChecks === 0 ? { interactionEvidenceUnverified: true, verifyWillFail: "interaction-evidence \u2014 the recording proves interactive poses none of the authored behaviors cover; not fixable from component code; REPORT it, do not iterate on it" } : {},
+      ...evidenceUnverified ? { interactionEvidenceUnverified: true, verifyWillFail: "interaction-evidence \u2014 the recording proves interactive poses none of the authored behaviors cover; not fixable from component code; REPORT it, do not iterate on it" } : {},
       certification: { certified: certifiedReps.length, total: scores.length, bar: certBar, note: "tierOf on exact values + parity and absent-ink demotion; verify's composition checks can demote further" }
     },
     () => {
@@ -10915,12 +11494,12 @@ METRIC DEADBAND (read before iterating on near-misses): the scored similarity/in
       process.stdout.write(`
 ${obj[0]}/${total} \xB7 certified ${certifiedReps.length}/${total} \xB7 floor=${obj[1].toFixed(3)} \xB7 mean=${obj[2].toFixed(3)} \xB7 evidence: ${evidenceDir}
 `);
-      const ic = interactionCoverage(behaviors);
-      if (interactionEvidence.length > 0 && ic.interactionChecks === 0) {
-        process.stdout.write(`INSTRUMENT GAP \u2014 the recording proves interactive poses (${interactionEvidence.join(", ")}) and zero interaction behaviors were authored; verify WILL fail this bundle (interaction-evidence). Not fixable from component code \u2014 report it, do not iterate on it.
+      if (evidenceUnverified) {
+        process.stdout.write(`INSTRUMENT GAP \u2014 the recording proves interactive poses (${(interactionEvidence ?? []).join(", ")}) and zero interaction behaviors were authored; verify WILL fail this bundle (interaction-evidence). Not fixable from component code \u2014 report it, do not iterate on it.
 `);
-      } else if (ic.interactionChecks === 0) {
-        process.stdout.write(`UNVERIFIED operability \u2014 0 interaction checks; the behaviour passes above are page-level style hygiene
+      } else {
+        const line = operabilityLine(operability);
+        if (line !== void 0) process.stdout.write(`${line}
 `);
       }
     }
@@ -11171,7 +11750,7 @@ var init_server = __esm({
     TOOLS = [
       {
         name: "tendril_record_plan",
-        description: "ENTRY POINT for implementing/building a React component from a Figma design or figma.com URL \u2014 start the Tendril pipeline here (after loading the tendril skill, if installed). Plans a recording session: computes the rep queue (anchor + one-factor + conflict crosses) from the verbatim get_metadata response (pass its blocks via metadataParts \u2014 no file to write) and persists the set manifest. Resumes if the set already exists. The output may carry USER QUESTIONS \u2014 defaultsToConfirm (which pose is the component's default) or a multiple-component-sets error (which set to record): render them to a present user and apply the answers via `defaults` / `componentSet`; non-interactive runs follow each question's stated fallback. Recording cost is stated in figmaCallEstimate, never asked about \u2014 proceed with what the user provided.",
+        description: "ENTRY POINT for implementing/building a React component from a Figma design or figma.com URL \u2014 start the Tendril pipeline here (after loading the tendril skill, if installed). Plans a recording session: computes the rep queue (anchor + one-factor + conflict crosses) from the verbatim get_metadata response (pass its blocks via metadataParts \u2014 no file to write) and persists the set manifest. Resumes if the set already exists. The output may carry USER QUESTIONS \u2014 defaultsToConfirm (which pose is the component's default) or a multiple-component-sets error (which set to record): render them to a present user and apply the answers via `defaults` / `componentSet`; non-interactive runs follow each question's stated fallback. It may also carry `interactionStatesToConfirm` \u2014 the recording holds no hover/focus/pressed state, so nothing shows how the component behaves when someone uses it: say its `statement` and `designFix` in that SAME one message (the fix is a Figma variant, not code). It is a disclosure, not a gate \u2014 no answer is required and recording proceeds regardless. The output also carries `feasibilityCheck`: the call arithmetic for this queue plus the free `whoami` check that turns it into a verdict \u2014 complete that handshake BEFORE the first recording call, and surface the verdict to the user when the set does not fit their daily allowance.",
         schema: z12.object({
           setDir: str("recording set directory to create/resume"),
           component: str("component/system name"),
@@ -13012,11 +13591,19 @@ function buildProgram() {
       await runFontsResolve2({ ...flags, family, weights: local["weights"].map(Number), cacheDir });
     }
   });
-  fonts.command("add").description("Register a font file you already license, so a kit using a proprietary face can be scored.").argument("<family>", 'font family name as the design uses it, e.g. "S\xF6hne"').argument("<weight>", "numeric weight, e.g. 400").argument("<file>", "path to a .woff2/.woff/.ttf/.otf you are licensed to use").option("--cache <dir>", "cache directory (default: the per-user font cache)").action(async (family, weight, file, _o, cmd) => {
+  fonts.command("add").description("Register a font file you already license, so a kit using a proprietary face can be scored.").argument("<family>", 'font family name as the design uses it, e.g. "S\xF6hne"').argument("<weight>", "numeric weight, e.g. 400").argument("<file>", "path to a .woff2/.woff/.ttf/.otf you are licensed to use").option("--cache <dir>", "cache directory (default: the per-user font cache)").option("--set <dir>", "recording set to verify the family spelling against \u2014 a face cached under a name the mount never matches leaves scoring refusing").option("--face <index>", "which face to lift out of a .ttc collection (the error lists them)").action(async (family, weight, file, _o, cmd) => {
     const flags = globalFlags(cmd.parent.parent);
     const local = cmd.opts();
     const { runFontsAdd: runFontsAdd2 } = await Promise.resolve().then(() => (init_fonts(), fonts_exports));
-    runFontsAdd2({ ...flags, family, weight: Number(weight), file, cacheDir: local["cache"] ?? DEFAULT_FONT_CACHE });
+    runFontsAdd2({
+      ...flags,
+      family,
+      weight: Number(weight),
+      file,
+      cacheDir: local["cache"] ?? DEFAULT_FONT_CACHE,
+      ...local["set"] !== void 0 ? { set: local["set"] } : {},
+      ...local["face"] !== void 0 ? { face: Number(local["face"]) } : {}
+    });
   });
   fonts.command("status").option("--lock <file>", "hash lock to verify against (e.g. packages/verify/fixtures/fonts.lock.json)").option("--cache <dir>", "cache directory (default: the per-user font cache)").action(async (_o, cmd) => {
     const flags = globalFlags(cmd.parent.parent);