@tendrilapp/cli 0.1.27 → 0.1.29

package/dist/tendril.js

@@ -1083,14 +1083,54 @@ function planSet(setDir, component, symbols, opts = {}) {
   writeManifest(setDir, manifest);
   return { manifest, plan, resumed: false };
 }
+function usableEnvelope(file, tool) {
+  let payload;
+  try {
+    payload = JSON.parse(readFileSync(file, "utf8"));
+  } catch {
+    return { ok: false, reason: "the recorded file is not JSON" };
+  }
+  const schema = tool === "get_screenshot" ? ImageEnvelopeSchema : TextEnvelopeSchema;
+  if (!schema.safeParse(payload).success) {
+    return { ok: false, reason: "not a verbatim tool envelope (structure the ingest boundary would refuse)" };
+  }
+  const content = checkEnvelopeContent(tool, payload);
+  if (!content.ok) return { ok: false, reason: content.reason };
+  if (tool === "get_metadata" && !/name="/.test(envelopeTextContent(payload))) {
+    return { ok: false, reason: "node markup carries no name attribute \u2014 task authoring cannot derive the pose" };
+  }
+  return { ok: true };
+}
 function sessionStatus(setDir) {
   const manifest = loadManifest(setDir);
   const reps = manifest.reps.map((rep) => {
-    const recorded = RECORD_TOOLS.filter((t) => existsSync(path.join(setDir, rep.slug, `${t}.json`)));
-    const missing = byProtocolOrder(requiredToolsFor(manifest, rep.slug).filter((t) => !recorded.includes(t)));
-    return { slug: rep.slug, nodeId: rep.nodeId, recorded, missing };
+    const required = requiredToolsFor(manifest, rep.slug);
+    const invalid = [];
+    const recorded = RECORD_TOOLS.filter((t) => {
+      const file = path.join(setDir, rep.slug, `${t}.json`);
+      if (!existsSync(file)) return false;
+      const usable = usableEnvelope(file, t);
+      if (!usable.ok) {
+        invalid.push({
+          tool: t,
+          reason: required.includes(t) ? usable.reason : `${usable.reason} (optional for this rep \u2014 not counted against completeness; re-record only if you need this evidence)`
+        });
+        return false;
+      }
+      return true;
+    });
+    const missing = byProtocolOrder(required.filter((t) => !recorded.includes(t)));
+    return { slug: rep.slug, nodeId: rep.nodeId, recorded, missing, ...invalid.length > 0 ? { invalid } : {} };
   });
-  return { reps, complete: reps.every((r) => r.missing.length === 0) };
+  const setDefsFile = path.join(setDir, "get_variable_defs.json");
+  const setDefs = existsSync(setDefsFile) ? usableEnvelope(setDefsFile, "get_variable_defs") : { ok: false, reason: "never recorded" };
+  const setTokenMapRecorded = setDefs.ok;
+  return {
+    reps,
+    setTokenMapRecorded,
+    ...!setDefs.ok && setDefs.reason !== "never recorded" ? { setTokenMapInvalid: setDefs.reason } : {},
+    complete: reps.every((r) => r.missing.length === 0) && setTokenMapRecorded
+  };
 }
 function nextInstruction(setDir) {
   const { reps } = sessionStatus(setDir);
@@ -1337,8 +1377,8 @@ var init_src = __esm({
 function variableNameToPath(name) {
   return name.split("/").map(canonicalCssIdentPart).filter((part) => part.length > 0);
 }
-function tokenPathToCssVar(path40) {
-  return `--${path40.join("-")}`;
+function tokenPathToCssVar(path41) {
+  return `--${path41.join("-")}`;
 }
 function toDtcgToken(variable, defaultMode) {
   const modes = Object.keys(variable.valuesByMode);
@@ -1382,11 +1422,11 @@ function toDtcgToken(variable, defaultMode) {
 }
 function mapVariablesToDtcg(variables, defaultMode = "light") {
   const entries = variables.map((variable) => {
-    const path40 = variableNameToPath(variable.name);
-    if (path40.length === 0) {
+    const path41 = variableNameToPath(variable.name);
+    if (path41.length === 0) {
       throw new DtcgMappingError("empty-name", `Figma variable ${variable.id} has an empty name`);
     }
-    return { variable, path: path40 };
+    return { variable, path: path41 };
   });
   const groupPrefixes = /* @__PURE__ */ new Set();
   for (const e of entries) {
@@ -1407,21 +1447,21 @@ function mapVariablesToDtcg(variables, defaultMode = "light") {
   }
   const tokens = {};
   const flat = [];
-  for (const { variable, path: path40 } of entries) {
+  for (const { variable, path: path41 } of entries) {
     const token = toDtcgToken(variable, defaultMode);
     let group = tokens;
-    for (const segment of path40.slice(0, -1)) {
+    for (const segment of path41.slice(0, -1)) {
       const existing = group[segment];
       group = existing ?? (group[segment] = {});
     }
-    const leaf = path40[path40.length - 1];
+    const leaf = path41[path41.length - 1];
     if (group[leaf] !== void 0) {
-      throw new DtcgMappingError("duplicate-path", `Duplicate token path "${path40.join(".")}" (variable ${variable.id})`);
+      throw new DtcgMappingError("duplicate-path", `Duplicate token path "${path41.join(".")}" (variable ${variable.id})`);
     }
     group[leaf] = token;
     flat.push({
-      path: path40.join("."),
-      cssVar: tokenPathToCssVar(path40),
+      path: path41.join("."),
+      cssVar: tokenPathToCssVar(path41),
       type: token.$type,
       value: token.$value
     });
@@ -1610,9 +1650,9 @@ function boundId(value) {
   return isObject(value) && typeof value["boundVariableId"] === "string" ? value["boundVariableId"] : void 0;
 }
 function resolveBinding(ctx, id) {
-  const path40 = ctx.pathById.get(id);
-  if (path40 === void 0) ctx.unresolved.add(id);
-  return path40;
+  const path41 = ctx.pathById.get(id);
+  if (path41 === void 0) ctx.unresolved.add(id);
+  return path41;
 }
 function parseVariantProps(name) {
   if (!name.includes("=")) return void 0;
@@ -1647,8 +1687,8 @@ function walk(ctx, raw) {
       if (!isObject(paint) || paint["visible"] === false) continue;
       const id = boundId(paint);
       if (id !== void 0) {
-        const path40 = resolveBinding(ctx, id);
-        if (path40 !== void 0) tokens.add(path40);
+        const path41 = resolveBinding(ctx, id);
+        if (path41 !== void 0) tokens.add(path41);
       } else if (typeof paint["color"] === "string") {
         ctx.hardcoded.push({ node: name, property, value: paint["color"] });
       }
@@ -1656,8 +1696,8 @@ function walk(ctx, raw) {
   }
   const radiusId = boundId(raw["cornerRadius"]);
   if (radiusId !== void 0) {
-    const path40 = resolveBinding(ctx, radiusId);
-    if (path40 !== void 0) tokens.add(path40);
+    const path41 = resolveBinding(ctx, radiusId);
+    if (path41 !== void 0) tokens.add(path41);
   } else if (typeof raw["cornerRadius"] === "number" && raw["cornerRadius"] !== 0) {
     ctx.hardcoded.push({ node: name, property: "border-radius", value: `${raw["cornerRadius"]}px` });
   }
@@ -1667,10 +1707,10 @@ function walk(ctx, raw) {
     layout = { mode: layoutMode === "HORIZONTAL" ? "flex-row" : "flex-column" };
     const gapId = boundId(raw["itemSpacing"]);
     if (gapId !== void 0) {
-      const path40 = resolveBinding(ctx, gapId);
-      if (path40 !== void 0) {
-        layout.gap = path40;
-        tokens.add(path40);
+      const path41 = resolveBinding(ctx, gapId);
+      if (path41 !== void 0) {
+        layout.gap = path41;
+        tokens.add(path41);
       }
     } else if (typeof raw["itemSpacing"] === "number" && raw["itemSpacing"] !== 0) {
       ctx.hardcoded.push({ node: name, property: "gap", value: `${raw["itemSpacing"]}px` });
@@ -1679,10 +1719,10 @@ function walk(ctx, raw) {
     for (const field of PADDING_FIELDS) {
       const id = boundId(raw[field]);
       if (id !== void 0) {
-        const path40 = resolveBinding(ctx, id);
-        if (path40 !== void 0) {
-          paddingPaths.push(path40);
-          tokens.add(path40);
+        const path41 = resolveBinding(ctx, id);
+        if (path41 !== void 0) {
+          paddingPaths.push(path41);
+          tokens.add(path41);
         }
       } else if (typeof raw[field] === "number" && raw[field] !== 0) {
         ctx.hardcoded.push({ node: name, property: field, value: `${raw[field]}px` });
@@ -3498,6 +3538,7 @@ function isCollection(bytes) {
 }
 function nameTableStrings(view, bytes, nameOffset, nameLength) {
   const out = /* @__PURE__ */ new Map();
+  const rank = /* @__PURE__ */ new Map();
   if (nameOffset + 6 > bytes.length) return out;
   const count = view.getUint16(nameOffset + 2);
   const stringOffset = nameOffset + view.getUint16(nameOffset + 4);
@@ -3511,14 +3552,21 @@ function nameTableStrings(view, bytes, nameOffset, nameLength) {
     const offset = stringOffset + view.getUint16(rec + 10);
     if (offset + length > bytes.length || offset + length > nameOffset + nameLength) continue;
     const slice = bytes.subarray(offset, offset + length);
-    const isUtf16 = platformId === 3 || platformId === 0 || encodingId === 1;
+    const languageId = view.getUint16(rec + 4);
     let value = "";
-    if (isUtf16) {
+    if (platformId === 3 || platformId === 0) {
       for (let j = 0; j + 1 < slice.length; j += 2) value += String.fromCharCode(slice[j] << 8 | slice[j + 1]);
-    } else {
+    } else if (platformId === 1 && encodingId === 0) {
       for (const b of slice) value += String.fromCharCode(b);
+    } else {
+      continue;
+    }
+    if (value === "") continue;
+    const score = platformId === 3 && languageId === 1033 ? 5 : platformId === 0 ? 4 : platformId === 1 && languageId === 0 ? 3 : platformId === 3 ? 2 : 1;
+    if (score > (rank.get(nameId) ?? 0)) {
+      rank.set(nameId, score);
+      out.set(nameId, value);
     }
-    if (value !== "" && !out.has(nameId)) out.set(nameId, value);
   }
   return out;
 }
@@ -3598,15 +3646,154 @@ var init_font_collection = __esm({
   }
 });
 
-// packages/verify/src/font-resolve.ts
-import { createHash } from "node:crypto";
-import { existsSync as existsSync6, mkdirSync as mkdirSync2, readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "node:fs";
+// packages/verify/src/font-discovery.ts
+import { existsSync as existsSync6, readdirSync as readdirSync2, readFileSync as readFileSync3, realpathSync as realpathSync2 } from "node:fs";
 import os2 from "node:os";
 import path10 from "node:path";
+function weightFromSubfamily(subfamily) {
+  for (const [re, w] of WEIGHT_TOKENS) if (re.test(subfamily)) return w;
+  return void 0;
+}
+function systemFaceRefusal(family) {
+  if (/^\.?SF(NS|[ -]|$)/i.test(family) || /^San Francisco/i.test(family) || /^\.?Apple/i.test(family) || /^\.?New York\b/i.test(family) || /^\.?System Font\b/i.test(family)) {
+    return "Apple's bundled system faces (San Francisco, New York, the Apple-named families) are licensed only for mock-ups of interfaces running on Apple operating systems, by registered Apple developers \u2014 a grant Tendril cannot verify, so these faces are never cached (ROADMAP 0i).";
+  }
+  if (/^\./.test(family)) {
+    return "dot-prefixed families are the operating system's own hidden UI faces (macOS marks internal faces with a leading dot) \u2014 not user-licensable, so they are never cached (ROADMAP 0i).";
+  }
+  if (/^Segoe UI Variable/i.test(family)) {
+    return "Segoe UI Variable cannot be licensed for use outside Microsoft products at all \u2014 an 'I have the rights' assertion has nothing it could attach to, so it is never cached (ROADMAP 0i).";
+  }
+  return void 0;
+}
+function faceAt(bytes, view, dirOffset, file, faceIndex) {
+  if (dirOffset + 12 > bytes.length || !SFNT_VERSIONS.has(view.getUint32(dirOffset))) return null;
+  const numTables = view.getUint16(dirOffset + 4);
+  let names = /* @__PURE__ */ new Map();
+  let os2Weight;
+  let os2Italic = false;
+  let variable = false;
+  for (let t = 0; t < numTables; t++) {
+    const rec = dirOffset + 12 + t * 16;
+    if (rec + 16 > bytes.length) break;
+    const tag = String.fromCharCode(bytes[rec], bytes[rec + 1], bytes[rec + 2], bytes[rec + 3]);
+    const offset = view.getUint32(rec + 8);
+    const length = view.getUint32(rec + 12);
+    if (tag === "name") names = nameTableStrings(view, bytes, offset, length);
+    else if (tag === "OS/2" && offset + 64 <= bytes.length) {
+      const w = view.getUint16(offset + 4);
+      if (w >= 1 && w <= 1e3) os2Weight = w;
+      os2Italic = (view.getUint16(offset + 62) & 1) !== 0;
+    } else if (tag === "fvar") variable = true;
+  }
+  const family = names.get(16) ?? names.get(1);
+  if (family === void 0 || family === "") return null;
+  const subfamily = names.get(17) ?? names.get(2) ?? "";
+  const italic = /italic|oblique|inclined|slanted/i.test(subfamily) || os2Italic;
+  const weight = weightFromSubfamily(subfamily) ?? os2Weight ?? 400;
+  return { family, subfamily, weight, italic, variable, file, ...faceIndex !== void 0 ? { faceIndex } : {} };
+}
+function facesInFile(file) {
+  try {
+    const bytes = new Uint8Array(readFileSync3(file));
+    if (bytes.length < 12) return [];
+    const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+    if (isCollection(bytes)) {
+      const numFonts = view.getUint32(8);
+      const faces = [];
+      for (let i = 0; i < numFonts; i++) {
+        const f = faceAt(bytes, view, view.getUint32(12 + i * 4), file, i);
+        if (f !== null) faces.push(f);
+      }
+      return faces;
+    }
+    const single = faceAt(bytes, view, 0, file);
+    return single === null ? [] : [single];
+  } catch {
+    return [];
+  }
+}
+function systemFontDirs() {
+  const env = process.env["TENDRIL_SYSTEM_FONT_DIRS"];
+  if (env !== void 0 && env !== "") return env.split(path10.delimiter).filter((d) => d !== "" && existsSync6(d));
+  const home = os2.homedir();
+  const dirs = process.platform === "darwin" ? ["/System/Library/Fonts", "/Library/Fonts", path10.join(home, "Library", "Fonts")] : process.platform === "win32" ? [
+    path10.join(process.env["WINDIR"] ?? "C:\\Windows", "Fonts"),
+    ...process.env["LOCALAPPDATA"] !== void 0 ? [path10.join(process.env["LOCALAPPDATA"], "Microsoft", "Windows", "Fonts")] : []
+  ] : ["/usr/share/fonts", "/usr/local/share/fonts", path10.join(home, ".fonts"), path10.join(home, ".local", "share", "fonts")];
+  return dirs.filter((d) => existsSync6(d));
+}
+function discoverSystemFaces(dirs = systemFontDirs(), depth = 3) {
+  const seen = /* @__PURE__ */ new Set();
+  const walk2 = (dirList, remaining) => {
+    const faces = [];
+    for (const dir of dirList) {
+      let entries;
+      try {
+        entries = readdirSync2(dir, { withFileTypes: true });
+      } catch {
+        continue;
+      }
+      for (const e of entries) {
+        const full = path10.join(dir, e.name);
+        if (e.isDirectory()) {
+          if (remaining > 1) faces.push(...walk2([full], remaining - 1));
+        } else if (FONT_EXTENSIONS.has(path10.extname(e.name).toLowerCase())) {
+          let key = full;
+          try {
+            key = realpathSync2(full);
+          } catch {
+          }
+          if (seen.has(key)) continue;
+          seen.add(key);
+          faces.push(...facesInFile(full));
+        }
+      }
+    }
+    return faces;
+  };
+  return walk2(dirs, depth);
+}
+function systemFacesForFamily(family, dirs) {
+  const want = normalize(family);
+  return discoverSystemFaces(dirs).filter((f) => normalize(f.family) === want);
+}
+var WEIGHT_TOKENS, SFNT_VERSIONS, FONT_EXTENSIONS, normalize;
+var init_font_discovery = __esm({
+  "packages/verify/src/font-discovery.ts"() {
+    "use strict";
+    init_font_collection();
+    WEIGHT_TOKENS = [
+      [/extra\s*light|ultra\s*light/i, 200],
+      [/extra\s*bold|ultra\s*bold/i, 800],
+      [/semi\s*bold|demi\s*bold|demi\b/i, 600],
+      [/\bthin\b|\bhairline\b/i, 100],
+      [/\blight\b/i, 300],
+      [/\bmedium\b/i, 500],
+      [/\bbold\b/i, 700],
+      [/\bblack\b|\bheavy\b/i, 900],
+      [/\bregular\b|\bnormal\b|\bbook\b|\broman\b/i, 400]
+    ];
+    SFNT_VERSIONS = /* @__PURE__ */ new Set([
+      65536,
+      1330926671,
+      1953658213
+      /* true */
+    ]);
+    FONT_EXTENSIONS = /* @__PURE__ */ new Set([".ttf", ".otf", ".ttc"]);
+    normalize = (s) => s.toLowerCase().replace(/\s+/g, " ").trim();
+  }
+});
+
+// packages/verify/src/font-resolve.ts
+import { createHash } from "node:crypto";
+import { existsSync as existsSync7, mkdirSync as mkdirSync2, readFileSync as readFileSync4, writeFileSync as writeFileSync3 } from "node:fs";
+import os3 from "node:os";
+import path11 from "node:path";
 function fontCacheDir() {
   const env = process.env["TENDRIL_FONT_CACHE"];
-  if (env !== void 0 && env !== "") return path10.resolve(env);
-  return path10.join(os2.homedir(), ".tendril", "fonts");
+  if (env !== void 0 && env !== "") return path11.resolve(env);
+  return path11.join(os3.homedir(), ".tendril", "fonts");
 }
 function normalizeFontLicense(value) {
   return typeof value === "string" && FONT_LICENSES.includes(value) ? value : "unknown";
@@ -3671,29 +3858,29 @@ async function resolveFonts(family, weights, cacheDir = DEFAULT_FONT_CACHE) {
       }
       const bytes = new Uint8Array(await fileRes.arrayBuffer());
       const sha256 = createHash("sha256").update(bytes).digest("hex");
-      const file = path10.join(cacheDir, `${family.toLowerCase().replace(/\s+/g, "-")}-${weight}.woff2`);
+      const file = path11.join(cacheDir, `${family.toLowerCase().replace(/\s+/g, "-")}-${weight}.woff2`);
       writeFileSync3(file, bytes);
       resolved.push({ family, weight, source: url, sha256, file, license: meta.license, ...meta.family !== null ? { servedFamily: meta.family } : {} });
     } catch (err) {
       failures.push({ family, weight, reason: `download failed: ${err instanceof Error ? err.message : String(err)}` });
     }
   }
-  const mPath = path10.join(cacheDir, "manifest.json");
-  const prior = existsSync6(mPath) ? JSON.parse(readFileSync3(mPath, "utf8")) : [];
-  const portable2 = resolved.map((m) => ({ ...m, file: path10.basename(m.file) }));
+  const mPath = path11.join(cacheDir, "manifest.json");
+  const prior = existsSync7(mPath) ? JSON.parse(readFileSync4(mPath, "utf8")) : [];
+  const portable2 = resolved.map((m) => ({ ...m, file: path11.basename(m.file) }));
   const merged = [...prior.filter((p) => !resolved.some((m) => m.family === p.family && m.weight === p.weight)), ...portable2];
   if (resolved.length > 0) writeFileSync3(mPath, `${JSON.stringify(merged, null, 2)}
 `);
   return { resolved, failures };
 }
-function addLocalFont(family, weight, filePath, cacheDir = DEFAULT_FONT_CACHE, faceIndex) {
-  const src = path10.resolve(filePath);
-  if (!existsSync6(src)) throw new Error(`font file not found: ${src}`);
-  const ext = path10.extname(src).toLowerCase();
+function addLocalFont(family, weight, filePath, cacheDir = DEFAULT_FONT_CACHE, faceIndex, provenance = "local") {
+  const src = path11.resolve(filePath);
+  if (!existsSync7(src)) throw new Error(`font file not found: ${src}`);
+  const ext = path11.extname(src).toLowerCase();
   if (![".woff2", ".woff", ".ttf", ".otf", ".ttc"].includes(ext)) {
     throw new Error(`unsupported font file "${ext}" \u2014 use .woff2 (preferred), .woff, .ttf, .otf or .ttc`);
   }
-  let bytes = new Uint8Array(readFileSync3(src));
+  let bytes = new Uint8Array(readFileSync4(src));
   if (bytes.length === 0) throw new Error(`font file is empty: ${src}`);
   let storedExt = ext;
   if (isCollection(bytes)) {
@@ -3703,7 +3890,7 @@ function addLocalFont(family, weight, filePath, cacheDir = DEFAULT_FONT_CACHE, f
       const all = listCollectionFaces(bytes);
       const shown = (candidates.length > 0 ? candidates : all).map((f) => `  --face ${f.index}  ${f.family ?? "(unnamed)"}${f.subfamily !== void 0 ? ` ${f.subfamily}` : ""}`).join("\n");
       throw new Error(
-        `${path10.basename(src)} is a collection of ${all.length} faces and ${candidates.length === 0 ? `none is named "${family}"` : `${candidates.length} match "${family}"`} \u2014 name the one you mean with --face <index>:
+        `${path11.basename(src)} is a collection of ${all.length} faces and ${candidates.length === 0 ? `none is named "${family}"` : `${candidates.length} match "${family}"`} \u2014 name the one you mean with --face <index>:
 ${shown}`
       );
     }
@@ -3712,20 +3899,20 @@ ${shown}`
   }
   mkdirSync2(cacheDir, { recursive: true });
   const sha256 = createHash("sha256").update(bytes).digest("hex");
-  const file = path10.join(cacheDir, `${family.toLowerCase().replace(/\s+/g, "-")}-${weight}${storedExt}`);
+  const file = path11.join(cacheDir, `${family.toLowerCase().replace(/\s+/g, "-")}-${weight}${storedExt}`);
   writeFileSync3(file, bytes);
-  const face = { family, weight, source: `local:${path10.basename(src)}`, sha256, file, license: "unknown" };
-  const mPath = path10.join(cacheDir, "manifest.json");
-  const prior = existsSync6(mPath) ? JSON.parse(readFileSync3(mPath, "utf8")) : [];
-  const merged = [...prior.filter((p) => !(p.family === family && p.weight === weight)), { ...face, file: path10.basename(file) }];
+  const face = { family, weight, source: `${provenance}:${path11.basename(src)}`, sha256, file, license: "unknown" };
+  const mPath = path11.join(cacheDir, "manifest.json");
+  const prior = existsSync7(mPath) ? JSON.parse(readFileSync4(mPath, "utf8")) : [];
+  const merged = [...prior.filter((p) => !(p.family === family && p.weight === weight)), { ...face, file: path11.basename(file) }];
   writeFileSync3(mPath, `${JSON.stringify(merged, null, 2)}
 `);
   return face;
 }
 function checkFontLock(lockPath, cacheDir = DEFAULT_FONT_CACHE) {
-  const lock = JSON.parse(readFileSync3(lockPath, "utf8"));
-  const mPath = path10.join(cacheDir, "manifest.json");
-  const manifest = existsSync6(mPath) ? JSON.parse(readFileSync3(mPath, "utf8")) : [];
+  const lock = JSON.parse(readFileSync4(lockPath, "utf8"));
+  const mPath = path11.join(cacheDir, "manifest.json");
+  const manifest = existsSync7(mPath) ? JSON.parse(readFileSync4(mPath, "utf8")) : [];
   return lock.map((l) => {
     const m = manifest.find((x) => x.family === l.family && x.weight === l.weight);
     if (m === void 0) return { family: l.family, weight: l.weight, status: "missing" };
@@ -3733,11 +3920,11 @@ function checkFontLock(lockPath, cacheDir = DEFAULT_FONT_CACHE) {
   });
 }
 function resolvedFontFamilies(cacheDir = DEFAULT_FONT_CACHE) {
-  const mPath = path10.join(cacheDir, "manifest.json");
-  if (!existsSync6(mPath)) return [];
+  const mPath = path11.join(cacheDir, "manifest.json");
+  if (!existsSync7(mPath)) return [];
   let entries;
   try {
-    entries = JSON.parse(readFileSync3(mPath, "utf8"));
+    entries = JSON.parse(readFileSync4(mPath, "utf8"));
   } catch {
     return [];
   }
@@ -3751,8 +3938,8 @@ function resolvedFontFamilies(cacheDir = DEFAULT_FONT_CACHE) {
   return [...byFamily.entries()].map(([family, w]) => ({ family, weights: [...w].sort((a, b) => a - b) }));
 }
 function requiredFontsManifest(families, cacheDir = DEFAULT_FONT_CACHE) {
-  const mPath = path10.join(cacheDir, "manifest.json");
-  const manifest = existsSync6(mPath) ? JSON.parse(readFileSync3(mPath, "utf8")) : [];
+  const mPath = path11.join(cacheDir, "manifest.json");
+  const manifest = existsSync7(mPath) ? JSON.parse(readFileSync4(mPath, "utf8")) : [];
   const wanted = new Set(families.map((f) => f.toLowerCase()));
   return manifest.filter((f) => wanted.has(f.family.toLowerCase())).map((f) => ({
     family: f.family,
@@ -3765,11 +3952,11 @@ function requiredFontsManifest(families, cacheDir = DEFAULT_FONT_CACHE) {
   }));
 }
 function facesMissingLicense(cacheDir = DEFAULT_FONT_CACHE) {
-  const mPath = path10.join(cacheDir, "manifest.json");
-  if (!existsSync6(mPath)) return [];
+  const mPath = path11.join(cacheDir, "manifest.json");
+  if (!existsSync7(mPath)) return [];
   let entries;
   try {
-    entries = JSON.parse(readFileSync3(mPath, "utf8"));
+    entries = JSON.parse(readFileSync4(mPath, "utf8"));
   } catch {
     return [];
   }
@@ -3778,31 +3965,88 @@ function facesMissingLicense(cacheDir = DEFAULT_FONT_CACHE) {
   ).map((e) => ({ family: e.family, weight: e.weight, sha256: e.sha256 }));
 }
 function verifiedFontFamilies(cacheDir = DEFAULT_FONT_CACHE) {
-  const mPath = path10.join(cacheDir, "manifest.json");
-  if (!existsSync6(mPath)) return [];
+  const mPath = path11.join(cacheDir, "manifest.json");
+  if (!existsSync7(mPath)) return [];
   let entries;
   try {
-    entries = JSON.parse(readFileSync3(mPath, "utf8"));
+    entries = JSON.parse(readFileSync4(mPath, "utf8"));
   } catch {
     return [];
   }
   const byFamily = /* @__PURE__ */ new Map();
   for (const e of entries) {
     if (typeof e.family !== "string" || typeof e.weight !== "number" || typeof e.file !== "string") continue;
-    const file = path10.isAbsolute(e.file) && existsSync6(e.file) ? e.file : path10.resolve(cacheDir, path10.basename(e.file));
-    if (!existsSync6(file)) continue;
-    if (createHash("sha256").update(readFileSync3(file)).digest("hex") !== e.sha256) continue;
+    const file = path11.isAbsolute(e.file) && existsSync7(e.file) ? e.file : path11.resolve(cacheDir, path11.basename(e.file));
+    if (!existsSync7(file)) continue;
+    if (createHash("sha256").update(readFileSync4(file)).digest("hex") !== e.sha256) continue;
     const set = byFamily.get(e.family) ?? /* @__PURE__ */ new Set();
     set.add(e.weight);
     byFamily.set(e.family, set);
   }
   return [...byFamily.entries()].map(([family, w]) => ({ family, weights: [...w].sort((a, b) => a - b) }));
 }
+function addSystemFamily(family, opts = {}) {
+  const refusal = systemFaceRefusal(family.trim());
+  if (refusal !== void 0) return { added: [], skipped: [], overwrote: [], refusal };
+  const plainStyle = (sub) => weightFromSubfamily(sub) !== void 0 || /^(regular|plain|)$/i.test(sub.trim());
+  const faces = [...systemFacesForFamily(family, opts.dirs)].sort((a, b) => {
+    const pa = plainStyle(a.subfamily) ? 0 : 1;
+    const pb = plainStyle(b.subfamily) ? 0 : 1;
+    if (pa !== pb) return pa - pb;
+    return a.subfamily.localeCompare(b.subfamily) || a.file.localeCompare(b.file) || (a.faceIndex ?? 0) - (b.faceIndex ?? 0);
+  });
+  const added = [];
+  const skipped = [];
+  const overwrote = [];
+  const cacheDir = opts.cacheDir ?? DEFAULT_FONT_CACHE;
+  const manifestFile = path11.join(cacheDir, "manifest.json");
+  const prior = existsSync7(manifestFile) ? JSON.parse(readFileSync4(manifestFile, "utf8")) : [];
+  const taken = /* @__PURE__ */ new Set();
+  for (const face of faces) {
+    const skip = (reason) => skipped.push({ subfamily: face.subfamily, weight: face.weight, reason });
+    const faceRefusal = systemFaceRefusal(face.family.trim());
+    if (faceRefusal !== void 0) {
+      skip(`refusal-class family \u2014 ${faceRefusal}`);
+      continue;
+    }
+    if (opts.weights !== void 0 && !opts.weights.includes(face.weight)) continue;
+    if (face.italic) {
+      skip("italic \u2014 the cache cannot represent italic faces end to end yet; the upright face serves the family");
+      continue;
+    }
+    if (face.variable) {
+      skip("variable font \u2014 the mount injects STATIC faces (a variable file renders thinner stems than recorded rasters, measured); install or point at a static instance");
+      continue;
+    }
+    if (/condensed|narrow|compressed|expanded|extended/i.test(face.subfamily)) {
+      skip("width variant \u2014 a Condensed/Expanded face is a different design, not a weight of this family");
+      continue;
+    }
+    if (taken.has(face.weight)) {
+      skip(`another face already provided weight ${face.weight}`);
+      continue;
+    }
+    taken.add(face.weight);
+    const existing = prior.find((p) => p.family.toLowerCase() === face.family.toLowerCase() && p.weight === face.weight);
+    if (existing !== void 0 && !existing.source.startsWith("system:")) {
+      overwrote.push({
+        family: face.family,
+        weight: face.weight,
+        priorSource: existing.source,
+        priorSha256: existing.sha256,
+        priorLicense: normalizeFontLicense(existing.license)
+      });
+    }
+    added.push({ ...addLocalFont(face.family, face.weight, face.file, cacheDir, face.faceIndex, "system"), subfamily: face.subfamily || "Regular" });
+  }
+  return { added, skipped, overwrote };
+}
 var DEFAULT_FONT_CACHE, UA, FONT_LICENSES, GOOGLE_LICENSE_IDS, GOOGLE_FONT_FILE_PREFIX;
 var init_font_resolve = __esm({
   "packages/verify/src/font-resolve.ts"() {
     "use strict";
     init_font_collection();
+    init_font_discovery();
     DEFAULT_FONT_CACHE = fontCacheDir();
     UA = "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.87 Safari/537.36";
     FONT_LICENSES = ["OFL-1.1", "Apache-2.0", "UFL-1.0", "proprietary", "unknown"];
@@ -3818,17 +4062,17 @@ var init_font_resolve = __esm({
 
 // packages/verify/src/font-faces.ts
 import { createHash as createHash2 } from "node:crypto";
-import { existsSync as existsSync7, readFileSync as readFileSync4 } from "node:fs";
-import path11 from "node:path";
+import { existsSync as existsSync8, readFileSync as readFileSync5 } from "node:fs";
+import path12 from "node:path";
 function injectedGroups(manifestPath2) {
-  if (!existsSync7(manifestPath2)) return { groups: [], shared: false };
-  const claimed = JSON.parse(readFileSync4(manifestPath2, "utf8"));
-  const resolveFile = (f) => path11.isAbsolute(f) && existsSync7(f) ? f : path11.resolve(path11.dirname(manifestPath2), path11.basename(f));
+  if (!existsSync8(manifestPath2)) return { groups: [], shared: false };
+  const claimed = JSON.parse(readFileSync5(manifestPath2, "utf8"));
+  const resolveFile = (f) => path12.isAbsolute(f) && existsSync8(f) ? f : path12.resolve(path12.dirname(manifestPath2), path12.basename(f));
   const byFile = /* @__PURE__ */ new Map();
   for (const f of claimed) {
     const file = resolveFile(f.file);
-    if (!existsSync7(file)) continue;
-    if (createHash2("sha256").update(readFileSync4(file)).digest("hex") !== f.sha256) continue;
+    if (!existsSync8(file)) continue;
+    if (createHash2("sha256").update(readFileSync5(file)).digest("hex") !== f.sha256) continue;
     const k = `${f.family}:${f.file}`;
     const e = byFile.get(k) ?? { family: f.family, weights: [], file };
     e.weights.push(f.weight);
@@ -3837,14 +4081,14 @@ function injectedGroups(manifestPath2) {
   const groups = [...byFile.values()];
   return { groups, shared: new Set(groups.map((e) => e.file)).size < groups.length };
 }
-function fontFaceCss(manifestPath2 = path11.join(fontCacheDir(), "manifest.json")) {
+function fontFaceCss(manifestPath2 = path12.join(fontCacheDir(), "manifest.json")) {
   const { groups, shared } = injectedGroups(manifestPath2);
   return groups.map((e) => {
     const weight = shared || e.weights.length > 1 ? `${SPAN[0]} ${SPAN[1]}` : String(e.weights[0]);
-    return `@font-face { font-family: '${e.family}'; font-weight: ${weight}; font-style: normal; src: url(data:font/woff2;base64,${readFileSync4(e.file).toString("base64")}) format('woff2'); }`;
+    return `@font-face { font-family: '${e.family}'; font-weight: ${weight}; font-style: normal; src: url(data:font/woff2;base64,${readFileSync5(e.file).toString("base64")}) format('woff2'); }`;
   }).join("\n");
 }
-function injectedFamilyWeights(manifestPath2 = path11.join(fontCacheDir(), "manifest.json")) {
+function injectedFamilyWeights(manifestPath2 = path12.join(fontCacheDir(), "manifest.json")) {
   const { groups, shared } = injectedGroups(manifestPath2);
   const out = /* @__PURE__ */ new Map();
   for (const g of groups) {
@@ -3869,17 +4113,17 @@ var init_font_faces = __esm({
 });
 
 // packages/verify/src/admission.ts
-import { readFileSync as readFileSync5, readdirSync as readdirSync2, existsSync as existsSync8, writeFileSync as writeFileSync4 } from "node:fs";
-import path12 from "node:path";
+import { readFileSync as readFileSync6, readdirSync as readdirSync3, existsSync as existsSync9, writeFileSync as writeFileSync4 } from "node:fs";
+import path13 from "node:path";
 import { build as build2 } from "esbuild";
 import postcss from "postcss";
 import tailwindcss from "tailwindcss";
 import { chromium as chromium2 } from "playwright-core";
 function fontWeightsByFamily() {
-  const mPath = path12.join(fontCacheDir(), "manifest.json");
+  const mPath = path13.join(fontCacheDir(), "manifest.json");
   const out = /* @__PURE__ */ new Map();
-  if (!existsSync8(mPath)) return out;
-  for (const f of JSON.parse(readFileSync5(mPath, "utf8")))
+  if (!existsSync9(mPath)) return out;
+  for (const f of JSON.parse(readFileSync6(mPath, "utf8")))
     out.set(f.family, [...out.get(f.family) ?? [], f.weight]);
   return out;
 }
@@ -3899,7 +4143,7 @@ var init_admission = __esm({
 });
 
 // packages/verify/src/tasks.ts
-import path13 from "node:path";
+import path14 from "node:path";
 var CALENDAR_CONFIGS, CALENDAR_API, CALENDAR_BEHAVIORS, BUTTON_CONFIGS, BUTTON_API, COMBO_FIX, COMBO_CONFIGS, COMBO_API, MODAL_CONFIGS, MODAL_API, BUTTON_BEHAVIORS, COMBO_BEHAVIORS, MODAL_BEHAVIORS, TASKS;
 var init_tasks = __esm({
   "packages/verify/src/tasks.ts"() {
@@ -4059,7 +4303,7 @@ BEHAVIORAL CONTRACT (machine-verified, gating): the primary action and close con
     ];
     TASKS = {
       calendar: {
-        set: path13.join(REPO_ROOT, "examples/recordings/shadcn-poc-calendar"),
+        set: path14.join(REPO_ROOT, "examples/recordings/shadcn-poc-calendar"),
         entry: "Calendar.tsx",
         configs: CALENDAR_CONFIGS,
         systemApi: CALENDAR_API,
@@ -4067,7 +4311,7 @@ BEHAVIORAL CONTRACT (machine-verified, gating): the primary action and close con
         prelude: { controls: ['[data-tendril-part="day"]'], textInputs: [] }
       },
       "shadcn-button": {
-        set: path13.join(REPO_ROOT, "examples/recordings/shadcn-poc-button"),
+        set: path14.join(REPO_ROOT, "examples/recordings/shadcn-poc-button"),
         entry: "Button.tsx",
         configs: BUTTON_CONFIGS,
         systemApi: BUTTON_API,
@@ -4075,7 +4319,7 @@ BEHAVIORAL CONTRACT (machine-verified, gating): the primary action and close con
         prelude: { controls: ["> *"], textInputs: [] }
       },
       combobox: {
-        set: path13.join(REPO_ROOT, "examples/recordings/carbon-poc-combobox"),
+        set: path14.join(REPO_ROOT, "examples/recordings/carbon-poc-combobox"),
         entry: "ComboBox.tsx",
         configs: COMBO_CONFIGS,
         systemApi: COMBO_API,
@@ -4083,7 +4327,7 @@ BEHAVIORAL CONTRACT (machine-verified, gating): the primary action and close con
         prelude: { controls: ['[role="option"]'], textInputs: ["input"], popover: { selector: '[role="listbox"]', trigger: "input" } }
       },
       modal: {
-        set: path13.join(REPO_ROOT, "examples/recordings/carbon-poc-modal"),
+        set: path14.join(REPO_ROOT, "examples/recordings/carbon-poc-modal"),
         entry: "Modal.tsx",
         configs: MODAL_CONFIGS,
         systemApi: MODAL_API,
@@ -4101,8 +4345,8 @@ __export(behavior_exports, {
   compileMount: () => compileMount,
   recordingIsDark: () => recordingIsDark
 });
-import { existsSync as existsSync9, readFileSync as readFileSync6 } from "node:fs";
-import path14 from "node:path";
+import { existsSync as existsSync10, readFileSync as readFileSync7 } from "node:fs";
+import path15 from "node:path";
 import { build as build3 } from "esbuild";
 import { chromium as chromium3 } from "playwright-core";
 import { PNG as PNG2 } from "pngjs";
@@ -4111,12 +4355,12 @@ function getFontFaces() {
   return _fontFaces;
 }
 async function compileMount(task, bundleDir) {
-  const entryTsx = path14.join(bundleDir, task.entry);
-  if (!existsSync9(entryTsx)) return { error: `${task.entry} missing` };
+  const entryTsx = path15.join(bundleDir, task.entry);
+  if (!existsSync10(entryTsx)) return { error: `${task.entry} missing` };
   const mountSrc = `
 import { createElement } from "react";
 import { createRoot } from "react-dom/client";
-import * as B from ${JSON.stringify(path14.resolve(entryTsx))};
+import * as B from ${JSON.stringify(path15.resolve(entryTsx))};
 const cfg = (window as unknown as { __cfg: { component: string; props: Record<string, unknown>; spyProps?: string[] } }).__cfg;
 const C = (B as Record<string, unknown>)[cfg.component] as Parameters<typeof createElement>[0] | undefined;
 // Callbacks cannot ride the JSON config: specs NAME spy props and the
@@ -4397,10 +4641,10 @@ async function runSteps(page, spec, renderPose) {
 function recordingIsDark(task) {
   const rep = task.configs[0]?.rep;
   if (rep === void 0) return false;
-  const f = path14.join(task.set, rep, "get_screenshot.json");
-  if (!existsSync9(f)) return false;
+  const f = path15.join(task.set, rep, "get_screenshot.json");
+  if (!existsSync10(f)) return false;
   try {
-    const env = JSON.parse(readFileSync6(f, "utf8")).content.find((c) => c.type === "image");
+    const env = JSON.parse(readFileSync7(f, "utf8")).content.find((c) => c.type === "image");
     if (env?.data === void 0) return false;
     const png = PNG2.sync.read(Buffer.from(env.data, "base64"));
     let sum = 0;
@@ -4472,7 +4716,7 @@ async function checkBehaviors(task, bundleDir, opts = {}) {
   const deadlineMs = timeoutMs + 1e4;
   const js = await compileMount(task, bundleDir);
   if (typeof js !== "string") return task.behaviors.map((b) => ({ id: b.id, pass: false, detail: js.error }));
-  const css = ["tokens.css", "styles.css"].map((f) => path14.join(bundleDir, f)).filter((f) => existsSync9(f)).map((f) => readFileSync6(f, "utf8")).join("\n");
+  const css = ["tokens.css", "styles.css"].map((f) => path15.join(bundleDir, f)).filter((f) => existsSync10(f)).map((f) => readFileSync7(f, "utf8")).join("\n");
   const server = await chromium3.launchServer({ executablePath: resolveChrome(), headless: true, args: mountArgs() });
   const browser = await chromium3.connect(server.wsEndpoint());
   const results = [];
@@ -4615,8 +4859,8 @@ var init_behavior = __esm({
 });
 
 // packages/verify/src/bundle-quality.ts
-import { readFileSync as readFileSync7, rmSync as rmSync2, writeFileSync as writeFileSync5, existsSync as existsSync10 } from "node:fs";
-import path15 from "node:path";
+import { readFileSync as readFileSync8, rmSync as rmSync2, writeFileSync as writeFileSync5, existsSync as existsSync11 } from "node:fs";
+import path16 from "node:path";
 function definedVars(tokensCss) {
   if (tokensCss === void 0) return void 0;
   const names = /* @__PURE__ */ new Set();
@@ -4625,19 +4869,19 @@ function definedVars(tokensCss) {
 }
 function recordedTokenMapState(setDir, reps) {
   const readMap = (file) => {
-    if (!existsSync10(file)) return void 0;
+    if (!existsSync11(file)) return void 0;
     try {
-      const parsed = JSON.parse(envelopeFirstTextPart(JSON.parse(readFileSync7(file, "utf8"))) || "{}");
+      const parsed = JSON.parse(envelopeFirstTextPart(JSON.parse(readFileSync8(file, "utf8"))) || "{}");
       return parsed !== null && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
     } catch {
       return {};
     }
   };
-  const setLevel = readMap(path15.join(setDir, "get_variable_defs.json"));
+  const setLevel = readMap(path16.join(setDir, "get_variable_defs.json"));
   if (setLevel !== void 0) return Object.keys(setLevel).length === 0 ? "empty" : "populated";
   let recorded = false;
   for (const rep of reps) {
-    const m = readMap(path15.join(setDir, rep, "get_variable_defs.json"));
+    const m = readMap(path16.join(setDir, rep, "get_variable_defs.json"));
     if (m === void 0) continue;
     recorded = true;
     if (Object.keys(m).length > 0) return "populated";
@@ -4702,11 +4946,11 @@ function fontStackFindings(sheets, coverage) {
 }
 async function checkBundleQuality(bundleDir, entry, set, fontManifest) {
   const findings = [];
-  const entryPath = path15.join(bundleDir, entry);
-  const cssPath = path15.join(bundleDir, "styles.css");
-  const tokensPath = path15.join(bundleDir, "tokens.css");
-  const css = existsSync10(cssPath) ? readFileSync7(cssPath, "utf8") : "";
-  const tokensCss = existsSync10(tokensPath) ? readFileSync7(tokensPath, "utf8") : void 0;
+  const entryPath = path16.join(bundleDir, entry);
+  const cssPath = path16.join(bundleDir, "styles.css");
+  const tokensPath = path16.join(bundleDir, "tokens.css");
+  const css = existsSync11(cssPath) ? readFileSync8(cssPath, "utf8") : "";
+  const tokensCss = existsSync11(tokensPath) ? readFileSync8(tokensPath, "utf8") : void 0;
   findings.push(
     ...fontStackFindings(
       [
@@ -4716,11 +4960,11 @@ async function checkBundleQuality(bundleDir, entry, set, fontManifest) {
       injectedFamilyWeights(fontManifest)
     )
   );
-  if (existsSync10(entryPath)) {
+  if (existsSync11(entryPath)) {
     const workDir = newScratchDir("quality");
     try {
-      const tsxPath = path15.join(workDir, entry);
-      writeFileSync5(tsxPath, readFileSync7(entryPath, "utf8"));
+      const tsxPath = path16.join(workDir, entry);
+      writeFileSync5(tsxPath, readFileSync8(entryPath, "utf8"));
       for (const d of runTscStrict([tsxPath]).diagnostics) {
         findings.push({ kind: "tsc", file: entry, ...d.line === void 0 ? {} : { line: d.line }, message: `TS${d.code}: ${d.message}` });
       }
@@ -4795,8 +5039,8 @@ var init_effect_geometry = __esm({
 });
 
 // packages/verify/src/bundle-score.ts
-import { existsSync as existsSync11, mkdirSync as mkdirSync3, readFileSync as readFileSync8, writeFileSync as writeFileSync6 } from "node:fs";
-import path16 from "node:path";
+import { existsSync as existsSync12, mkdirSync as mkdirSync3, readFileSync as readFileSync9, writeFileSync as writeFileSync6 } from "node:fs";
+import path17 from "node:path";
 import { build as build4 } from "esbuild";
 import { chromium as chromium4 } from "playwright-core";
 function getFontFaces2() {
@@ -4850,7 +5094,7 @@ function chooseSeat(cropAt, ref, padW, padH, backdrop, origin, extents) {
 }
 function metadataRoot(set, rep) {
   try {
-    const text = JSON.parse(readFileSync8(path16.join(set, rep, "get_metadata.json"), "utf8")).content.map((c) => c.text ?? "").join("\n");
+    const text = JSON.parse(readFileSync9(path17.join(set, rep, "get_metadata.json"), "utf8")).content.map((c) => c.text ?? "").join("\n");
     return parseMetadataStructure(text);
   } catch {
     return void 0;
@@ -4905,19 +5149,19 @@ function smallSemanticNodes(set, rep, maxArea = 1024) {
   });
 }
 function repMeta(set, rep) {
-  const text = JSON.parse(readFileSync8(path16.join(set, rep, "get_metadata.json"), "utf8")).content.map((c) => c.text ?? "").join("\n");
+  const text = JSON.parse(readFileSync9(path17.join(set, rep, "get_metadata.json"), "utf8")).content.map((c) => c.text ?? "").join("\n");
   const root = parseMetadataStructure(text);
   return { w: Math.round(root.width ?? 100), h: Math.round(root.height ?? 40) };
 }
 function repRef(set, rep) {
-  const env = JSON.parse(readFileSync8(path16.join(set, rep, "get_screenshot.json"), "utf8")).content.find((c) => c.type === "image");
+  const env = JSON.parse(readFileSync9(path17.join(set, rep, "get_screenshot.json"), "utf8")).content.find((c) => c.type === "image");
   return Uint8Array.from(Buffer.from(env?.data ?? "", "base64"));
 }
 function repEffectExtents(set, rep) {
-  const file = path16.join(set, rep, "get_design_context.json");
-  if (!existsSync11(file)) return void 0;
+  const file = path17.join(set, rep, "get_design_context.json");
+  if (!existsSync12(file)) return void 0;
   try {
-    const text = JSON.parse(readFileSync8(file, "utf8")).content.map((c) => c.text ?? "").join("\n");
+    const text = JSON.parse(readFileSync9(file, "utf8")).content.map((c) => c.text ?? "").join("\n");
     const extents = shadowExtents(text);
     return extents.top + extents.right + extents.bottom + extents.left > 0 ? extents : void 0;
   } catch {
@@ -4928,13 +5172,13 @@ async function scoreBundleForTask(task, bundleDir, bar = BAR, opts = {}) {
   if (opts.evidenceDir !== void 0) mkdirSync3(opts.evidenceDir, { recursive: true });
   const CONFIGS2 = task.configs;
   const timeoutMs = opts.mountDeadlineMs ?? ENGINE_MOUNT_DEADLINE_MS;
-  const entryTsx = path16.join(bundleDir, task.entry);
-  if (!existsSync11(entryTsx)) return CONFIGS2.map((c) => ({ rep: c.rep, similarity: 0, inkRecall: 0, exact: { similarity: 0, inkRecall: 0 }, pass: false, error: `${task.entry} missing` }));
-  const css = ["tokens.css", "styles.css"].map((f) => path16.join(bundleDir, f)).filter((f) => existsSync11(f)).map((f) => readFileSync8(f, "utf8")).join("\n");
+  const entryTsx = path17.join(bundleDir, task.entry);
+  if (!existsSync12(entryTsx)) return CONFIGS2.map((c) => ({ rep: c.rep, similarity: 0, inkRecall: 0, exact: { similarity: 0, inkRecall: 0 }, pass: false, error: `${task.entry} missing` }));
+  const css = ["tokens.css", "styles.css"].map((f) => path17.join(bundleDir, f)).filter((f) => existsSync12(f)).map((f) => readFileSync9(f, "utf8")).join("\n");
   const mountSrc = `
 import { createElement } from "react";
 import { createRoot } from "react-dom/client";
-import * as B from ${JSON.stringify(path16.resolve(entryTsx))};
+import * as B from ${JSON.stringify(path17.resolve(entryTsx))};
 const cfg = (window as unknown as { __cfg: { component: string; props: Record<string, unknown> } }).__cfg;
 const C = (B as Record<string, unknown>)[cfg.component] as Parameters<typeof createElement>[0] | undefined;
 const root = document.getElementById("root");
@@ -5029,12 +5273,12 @@ body{margin:0;background:rgb(${backdrop.join(",")})}
             return name === void 0 ? c : { ...c, name };
           });
           if (opts.evidenceDir !== void 0) {
-            writeFileSync6(path16.join(opts.evidenceDir, `${cfg.rep}-render.png`), scored);
-            writeFileSync6(path16.join(opts.evidenceDir, `${cfg.rep}-ref.png`), ref);
-            writeFileSync6(path16.join(opts.evidenceDir, `${cfg.rep}-diff.png`), diffPng(scored, ref));
+            writeFileSync6(path17.join(opts.evidenceDir, `${cfg.rep}-render.png`), scored);
+            writeFileSync6(path17.join(opts.evidenceDir, `${cfg.rep}-ref.png`), ref);
+            writeFileSync6(path17.join(opts.evidenceDir, `${cfg.rep}-diff.png`), diffPng(scored, ref));
             for (const [i, c] of absent.slice(0, 3).entries()) {
-              writeFileSync6(path16.join(opts.evidenceDir, `${cfg.rep}-absent-${i}-ref.png`), zoomCrop(ref, c));
-              writeFileSync6(path16.join(opts.evidenceDir, `${cfg.rep}-absent-${i}-render.png`), zoomCrop(scored, c));
+              writeFileSync6(path17.join(opts.evidenceDir, `${cfg.rep}-absent-${i}-ref.png`), zoomCrop(ref, c));
+              writeFileSync6(path17.join(opts.evidenceDir, `${cfg.rep}-absent-${i}-render.png`), zoomCrop(scored, c));
             }
           }
           return {
@@ -5142,15 +5386,15 @@ var init_prelude = __esm({
 });
 
 // packages/verify/src/parity.ts
-import { existsSync as existsSync12, readFileSync as readFileSync9 } from "node:fs";
-import path17 from "node:path";
+import { existsSync as existsSync13, readFileSync as readFileSync10 } from "node:fs";
+import path18 from "node:path";
 import { chromium as chromium6 } from "playwright-core";
 function getFontFaces3() {
   _fontFaces3 ??= fontFaceCss();
   return _fontFaces3;
 }
-function hoverForcedConfigs(task) {
-  return task.configs.filter((c) => {
+function hoverForcedConfigs(authority) {
+  return authority.filter((c) => {
     const forced = c.props["data-tendril-state"];
     return typeof forced === "string" && forced.split(/\s+/).includes("hover");
   });
@@ -5165,27 +5409,37 @@ function withoutHoverToken(props) {
   }
   return rest;
 }
-async function checkHoverParity(task, bundleDir, opts = {}) {
-  const configs = hoverForcedConfigs(task);
+async function checkHoverParity(task, bundleDir, authority, opts = {}) {
+  const configs = hoverForcedConfigs(authority);
   if (configs.length === 0) return [];
   const timeoutMs = opts.mountDeadlineMs ?? ENGINE_MOUNT_DEADLINE_MS;
   const deadlineMs = timeoutMs + 1e4;
   const js = await compileMount(task, bundleDir);
   if (typeof js !== "string") return configs.map((c) => ({ id: `parity:${c.rep}`, pass: false, detail: js.error }));
-  const css = ["tokens.css", "styles.css"].map((f) => path17.join(bundleDir, f)).filter((f) => existsSync12(f)).map((f) => readFileSync9(f, "utf8")).join("\n");
+  const css = ["tokens.css", "styles.css"].map((f) => path18.join(bundleDir, f)).filter((f) => existsSync13(f)).map((f) => readFileSync10(f, "utf8")).join("\n");
   const server = await chromium6.launchServer({ executablePath: resolveChrome(), headless: true, args: mountArgs() });
   const browser = await chromium6.connect(server.wsEndpoint());
   const results = [];
   try {
     for (const cfg of configs) {
-      const shoot = async (props, realHover) => {
+      const box = (() => {
+        try {
+          return repMeta(task.set, cfg.rep);
+        } catch {
+          return void 0;
+        }
+      })();
+      const rootCss = box === void 0 ? "#root{position:static;display:inline-block}" : `#root{width:${box.w}px;height:${box.h}px;position:absolute;left:20px;top:20px}
+#root > *{min-width:${box.w}px;min-height:${box.h}px}`;
+      const viewport = box === void 0 ? { width: 900, height: 700 } : { width: box.w + 48, height: box.h + 48 };
+      const shoot = async (component, props, realHover) => {
         const html = `<!doctype html><html><head><meta charset="utf-8"><style>
 ${getFontFaces3()}
 ${css}
 body{margin:0;padding:20px}
-#root{position:static;display:inline-block}
-</style></head><body><div id="root"></div><script>window.__cfg=${JSON.stringify({ component: cfg.component, props })}</script><script>${js}</script></body></html>`;
-        const page = await browser.newPage({ viewport: { width: 900, height: 700 } });
+${rootCss}
+</style></head><body><div id="root"></div><script>window.__cfg=${JSON.stringify({ component, props })}</script><script>${js}</script></body></html>`;
+        const page = await browser.newPage({ viewport });
         try {
           page.setDefaultTimeout(timeoutMs);
           await page.route("**/*", (route) => route.request().url().startsWith("data:") ? route.continue() : route.abort());
@@ -5199,15 +5453,30 @@ body{margin:0;padding:20px}
           } else {
             await page.waitForTimeout(400);
           }
-          return await page.screenshot({ clip: { x: 0, y: 0, width: 900, height: 700 } });
+          return await page.screenshot({ clip: { x: 0, y: 0, width: viewport.width, height: viewport.height } });
         } finally {
           await page.close();
         }
       };
       const work = (async () => {
-        const forcedShot = await shoot(cfg.props, false);
+        const adapter = task.configs.find((c) => c.rep === cfg.rep);
+        if (adapter === void 0) {
+          return { id: `parity:${cfg.rep}`, pass: false, detail: "the recording proves this hover pose and the bundle's adapter does not map it \u2014 an unmapped config is a FAIL, not an exemption from the check" };
+        }
+        const forcedShot = await shoot(adapter.component, cfg.props, false);
         if (!Buffer.isBuffer(forcedShot)) return { id: `parity:${cfg.rep}`, pass: false, detail: `forced mount: ${forcedShot.error}` };
-        const realShot = await shoot(withoutHoverToken(cfg.props), true);
+        if (JSON.stringify(adapter.props) !== JSON.stringify(cfg.props)) {
+          const adapterShot = await shoot(adapter.component, adapter.props, false);
+          if (!Buffer.isBuffer(adapterShot)) return { id: `parity:${cfg.rep}`, pass: false, detail: `adapter mount: ${adapterShot.error}` };
+          if (Buffer.compare(adapterShot, forcedShot) !== 0) {
+            return {
+              id: `parity:${cfg.rep}`,
+              pass: false,
+              detail: `the adapter drives this hover pose through props that do not render what the prescribed API renders (adapter ${JSON.stringify(adapter.props)} vs authored ${JSON.stringify(cfg.props)}) \u2014 the forcing contract is part of the certified surface; align the adapter with the authored API`
+            };
+          }
+        }
+        const realShot = await shoot(adapter.component, withoutHoverToken(cfg.props), true);
         if (!Buffer.isBuffer(realShot)) return { id: `parity:${cfg.rep}`, pass: false, detail: `real-hover mount: ${realShot.error}` };
         if (Buffer.compare(forcedShot, realShot) !== 0) {
           return {
@@ -5247,13 +5516,14 @@ var init_parity = __esm({
     init_behavior();
     init_font_faces();
     init_mount_limits();
+    init_bundle_score();
   }
 });
 
 // packages/verify/src/composition.ts
 import { createRequire as createRequire2 } from "node:module";
-import { existsSync as existsSync13, readFileSync as readFileSync10 } from "node:fs";
-import path18 from "node:path";
+import { existsSync as existsSync14, readFileSync as readFileSync11 } from "node:fs";
+import path19 from "node:path";
 import { build as build6 } from "esbuild";
 import { chromium as chromium7 } from "playwright-core";
 function getFontFaces4() {
@@ -5261,9 +5531,9 @@ function getFontFaces4() {
   return _fontFaces4;
 }
 async function compileInstrumentedMount(task, bundleDir) {
-  const entryTsx = path18.join(bundleDir, task.entry);
-  if (!existsSync13(entryTsx)) return { error: `${task.entry} missing` };
-  const requireFromVerify = createRequire2(path18.join(VERIFY_PKG_DIR, "package.json"));
+  const entryTsx = path19.join(bundleDir, task.entry);
+  if (!existsSync14(entryTsx)) return { error: `${task.entry} missing` };
+  const requireFromVerify = createRequire2(path19.join(VERIFY_PKG_DIR, "package.json"));
   let realJsxPath;
   try {
     realJsxPath = requireFromVerify.resolve("react/jsx-runtime");
@@ -5274,7 +5544,7 @@ async function compileInstrumentedMount(task, bundleDir) {
 import { createElement } from "react";
 import { createRoot } from "react-dom/client";
 import { __registerParts } from "react/jsx-runtime";
-import * as B from ${JSON.stringify(path18.resolve(entryTsx))};
+import * as B from ${JSON.stringify(path19.resolve(entryTsx))};
 const cfg = (window as unknown as { __cfg: { component: string; props: Record<string, unknown>; partComponents: string[] } }).__cfg;
 const pairs: Array<[unknown, string]> = [];
 for (const name of cfg.partComponents) {
@@ -5329,7 +5599,7 @@ function expectedParts(task, roles, mainSlug) {
 }
 function interiorRegions(setDir, roles) {
   const mains = roles.main;
-  const withInterior = mains.filter((m) => existsSync13(path18.join(setDir, m, "get_metadata_interior.json")));
+  const withInterior = mains.filter((m) => existsSync14(path19.join(setDir, m, "get_metadata_interior.json")));
   if (withInterior.length === 0) {
     return { unavailable: "no interior geometry recorded for any main (pre-obligation set) \u2014 re-record with `tendril record` to enable crop checks" };
   }
@@ -5346,7 +5616,7 @@ async function checkCropComposition(task, bundleDir, regions, opts = {}) {
   if (typeof js !== "string") {
     return regions.map((r) => ({ id: cropId(r), pass: false, similarity: 0, inkRecall: 0, detail: js.error }));
   }
-  const css = ["tokens.css", "styles.css"].map((f) => path18.join(bundleDir, f)).filter((f) => existsSync13(f)).map((f) => readFileSync10(f, "utf8")).join("\n");
+  const css = ["tokens.css", "styles.css"].map((f) => path19.join(bundleDir, f)).filter((f) => existsSync14(f)).map((f) => readFileSync11(f, "utf8")).join("\n");
   const server = await chromium7.launchServer({ executablePath: resolveChrome(), headless: true, args: mountArgs() });
   const browser = await chromium7.connect(server.wsEndpoint());
   const PAD = 4;
@@ -5451,7 +5721,7 @@ async function checkStructuralComposition(task, bundleDir, roles, opts = {}) {
   const deadlineMs = timeoutMs + 1e4;
   const js = await compileInstrumentedMount(task, bundleDir);
   if (typeof js !== "string") return [...results, ...mains.map((m) => ({ id: `composition:${m}`, pass: false, detail: js.error }))];
-  const css = ["tokens.css", "styles.css"].map((f) => path18.join(bundleDir, f)).filter((f) => existsSync13(f)).map((f) => readFileSync10(f, "utf8")).join("\n");
+  const css = ["tokens.css", "styles.css"].map((f) => path19.join(bundleDir, f)).filter((f) => existsSync14(f)).map((f) => readFileSync11(f, "utf8")).join("\n");
   const server = await chromium7.launchServer({ executablePath: resolveChrome(), headless: true, args: mountArgs() });
   const browser = await chromium7.connect(server.wsEndpoint());
   try {
@@ -5541,17 +5811,17 @@ export const jsxs = (t, p, k) => real.jsxs(t, inject(t, p), k);
 });
 
 // packages/verify/src/occlusion.ts
-import { existsSync as existsSync14 } from "node:fs";
-import path19 from "node:path";
+import { existsSync as existsSync15 } from "node:fs";
+import path20 from "node:path";
 import { build as build7 } from "esbuild";
 import { chromium as chromium8 } from "playwright-core";
 async function compileTwoUp(task, bundleDir) {
-  const entryTsx = path19.join(bundleDir, task.entry);
-  if (!existsSync14(entryTsx)) return { error: `${task.entry} missing` };
+  const entryTsx = path20.join(bundleDir, task.entry);
+  if (!existsSync15(entryTsx)) return { error: `${task.entry} missing` };
   const src = `
 import { createElement } from "react";
 import { createRoot } from "react-dom/client";
-import * as B from ${JSON.stringify(path19.resolve(entryTsx))};
+import * as B from ${JSON.stringify(path20.resolve(entryTsx))};
 const cfg = (window as unknown as { __cfg: { component: string; props: Record<string, unknown> } }).__cfg;
 const C = (B as Record<string, unknown>)[cfg.component] as Parameters<typeof createElement>[0] | undefined;
 for (const id of ["first", "second"]) {
@@ -5720,6 +5990,7 @@ var init_src4 = __esm({
     init_prelude();
     init_mount_limits();
     init_font_collection();
+    init_font_discovery();
     init_font_faces();
     init_font_resolve();
     init_paths();
@@ -5730,23 +6001,23 @@ var init_src4 = __esm({
 });
 
 // packages/cli/src/environment.ts
-import { existsSync as existsSync15, readFileSync as readFileSync11 } from "node:fs";
-import path20 from "node:path";
+import { existsSync as existsSync16, readFileSync as readFileSync12 } from "node:fs";
+import path21 from "node:path";
 import { createHash as createHash3 } from "node:crypto";
 import { fileURLToPath as fileURLToPath5 } from "node:url";
 function cliVersion() {
   try {
-    return JSON.parse(readFileSync11(path20.join(path20.dirname(fileURLToPath5(import.meta.url)), "..", "package.json"), "utf8")).version ?? "dev";
+    return JSON.parse(readFileSync12(path21.join(path21.dirname(fileURLToPath5(import.meta.url)), "..", "package.json"), "utf8")).version ?? "dev";
   } catch {
     return "dev";
   }
 }
 function environmentStamp(taskFamilies) {
-  const manifestPath2 = path20.join(fontCacheDir(), "manifest.json");
+  const manifestPath2 = path21.join(fontCacheDir(), "manifest.json");
   let fontsHash = null;
-  if (existsSync15(manifestPath2)) {
+  if (existsSync16(manifestPath2)) {
     try {
-      const entries = JSON.parse(readFileSync11(manifestPath2, "utf8"));
+      const entries = JSON.parse(readFileSync12(manifestPath2, "utf8"));
       const scoped = taskFamilies === void 0 || taskFamilies === null ? entries : entries.filter((f) => taskFamilies.some((fam) => fam.toLowerCase() === f.family.toLowerCase()));
       const faces = scoped.map((f) => `${f.family}:${f.weight}:${f.sha256}`).sort();
       fontsHash = faces.length === 0 ? null : createHash3("sha256").update(faces.join("\n")).digest("hex").slice(0, 16);
@@ -5790,8 +6061,8 @@ var init_describe = __esm({
 });
 
 // packages/cli/src/env.ts
-import { existsSync as existsSync16, readFileSync as readFileSync12 } from "node:fs";
-import path21 from "node:path";
+import { existsSync as existsSync17, readFileSync as readFileSync13 } from "node:fs";
+import path22 from "node:path";
 function parseEnv(content) {
   const entries = /* @__PURE__ */ new Map();
   for (const line of content.split("\n")) {
@@ -5803,9 +6074,9 @@ function parseEnv(content) {
 function resolveCredential(name) {
   const fromProcess = process.env[name];
   if (fromProcess) return fromProcess;
-  const envPath = path21.resolve(process.env["INIT_CWD"] ?? process.cwd(), ".env");
-  if (!existsSync16(envPath)) return void 0;
-  return parseEnv(readFileSync12(envPath, "utf8")).get(name);
+  const envPath = path22.resolve(process.env["INIT_CWD"] ?? process.cwd(), ".env");
+  if (!existsSync17(envPath)) return void 0;
+  return parseEnv(readFileSync13(envPath, "utf8")).get(name);
 }
 var init_env = __esm({
   "packages/cli/src/env.ts"() {
@@ -5865,17 +6136,17 @@ var init_output = __esm({
 });
 
 // packages/cli/src/entitlement.ts
-import { chmodSync, existsSync as existsSync17, mkdirSync as mkdirSync4, readFileSync as readFileSync13, writeFileSync as writeFileSync7 } from "node:fs";
+import { chmodSync, existsSync as existsSync18, mkdirSync as mkdirSync4, readFileSync as readFileSync14, writeFileSync as writeFileSync7 } from "node:fs";
 import crypto from "node:crypto";
-import os3 from "node:os";
-import path22 from "node:path";
+import os4 from "node:os";
+import path23 from "node:path";
 function entitlementPath() {
-  return process.env["TENDRIL_ENTITLEMENT_PATH"] ?? path22.join(os3.homedir(), ".tendril", "entitlement.json");
+  return process.env["TENDRIL_ENTITLEMENT_PATH"] ?? path23.join(os4.homedir(), ".tendril", "entitlement.json");
 }
 function readStoredEntitlement(file = entitlementPath()) {
-  if (!existsSync17(file)) return void 0;
+  if (!existsSync18(file)) return void 0;
   try {
-    const parsed = JSON.parse(readFileSync13(file, "utf8"));
+    const parsed = JSON.parse(readFileSync14(file, "utf8"));
     if (typeof parsed.token !== "string" || typeof parsed.lastRefreshAt !== "number") return void 0;
     return { token: parsed.token, lastRefreshAt: parsed.lastRefreshAt };
   } catch {
@@ -5883,7 +6154,7 @@ function readStoredEntitlement(file = entitlementPath()) {
   }
 }
 function writeStoredEntitlement(stored, file = entitlementPath()) {
-  mkdirSync4(path22.dirname(file), { recursive: true });
+  mkdirSync4(path23.dirname(file), { recursive: true });
   writeFileSync7(file, `${JSON.stringify(stored, null, 2)}
 `);
   chmodSync(file, 384);
@@ -5968,9 +6239,9 @@ var init_entitlement = __esm({
 
 // packages/cli/src/commands/doctor.ts
 import { spawnSync } from "node:child_process";
-import { existsSync as existsSync18, readFileSync as readFileSync14, readdirSync as readdirSync3 } from "node:fs";
-import os4 from "node:os";
-import path23 from "node:path";
+import { existsSync as existsSync19, readFileSync as readFileSync15, readdirSync as readdirSync4 } from "node:fs";
+import os5 from "node:os";
+import path24 from "node:path";
 function withDeadline(work, ms) {
   return Promise.race([
     work,
@@ -6030,19 +6301,19 @@ async function runDoctorChecks(options) {
       remediation: "Install Google Chrome (or Chromium), or set CHROME_PATH to a Chromium-family browser binary."
     });
   }
-  const fontManifest = path23.join(fontCacheDir(), "manifest.json");
+  const fontManifest = path24.join(fontCacheDir(), "manifest.json");
   checks.push(
-    existsSync18(fontManifest) ? { name: "font-cache", ok: true, detail: `resolved font cache at ${fontCacheDir()} (${JSON.parse(readFileSync14(fontManifest, "utf8")).length} faces)` } : {
+    existsSync19(fontManifest) ? { name: "font-cache", ok: true, detail: `resolved font cache at ${fontCacheDir()} (${JSON.parse(readFileSync15(fontManifest, "utf8")).length} faces)` } : {
       name: "font-cache",
       ok: true,
       detail: `font cache empty at ${fontCacheDir()} \u2014 normal on a fresh machine; faces resolve per design system at first use`,
       remediation: `Nothing to do now: \`${tendrilCommand("fonts resolve --set <recording-dir>")}\` fetches exactly what a recording declares, and generate/verify name that command \u2014 with the set filled in \u2014 when they need it.`
     }
   );
-  const pluginRoot = path23.join(os4.homedir(), ".claude", "plugins", "cache", "tendrilapp", "tendril");
-  if (existsSync18(pluginRoot)) {
+  const pluginRoot = path24.join(os5.homedir(), ".claude", "plugins", "cache", "tendrilapp", "tendril");
+  if (existsSync19(pluginRoot)) {
     try {
-      const versions = readdirSync3(pluginRoot).filter((v) => /^\d+\.\d+\.\d+$/.test(v));
+      const versions = readdirSync4(pluginRoot).filter((v) => /^\d+\.\d+\.\d+$/.test(v));
       const newest = versions.sort((a, b) => versionIsNewer(a, b) ? 1 : -1)[0];
       if (newest !== void 0) {
         const skewed = versionIsNewer(newest, cliVersion());
@@ -7566,9 +7837,9 @@ __export(record_exports, {
   runRecordPlan: () => runRecordPlan,
   runRecordStatus: () => runRecordStatus
 });
-import { existsSync as existsSync20, mkdtempSync as mkdtempSync2, readFileSync as readFileSync16, readdirSync as readdirSync5 } from "node:fs";
-import os5 from "node:os";
-import path26 from "node:path";
+import { existsSync as existsSync21, mkdtempSync as mkdtempSync2, readFileSync as readFileSync17, readdirSync as readdirSync6 } from "node:fs";
+import os6 from "node:os";
+import path27 from "node:path";
 import { writeFileSync as writeFileSync9 } from "node:fs";
 function recordsInteractionState(reports) {
   const evident = (s) => stateTokens(s).some((t) => INTERACTION_EVIDENCE_VALUES.has(t));
@@ -7591,7 +7862,7 @@ function interactionDisclosure(component, reports) {
   };
 }
 function symbolsFromMetadataEnvelope(file, sourceFrame) {
-  const env = JSON.parse(readFileSync16(file, "utf8"));
+  const env = JSON.parse(readFileSync17(file, "utf8"));
   const text = env.content.map((c) => c.text ?? "").join("\n");
   const symbols = [];
   const walk2 = (node, ancestor) => {
@@ -7649,7 +7920,7 @@ function runRecordPlan(opts) {
   if (rawFile !== void 0) {
     try {
       const envelope = rawEnvelopeFromFile(rawFile, opts.metadataRawPartsFile !== void 0);
-      const tmp = path26.join(mkdtempSync2(path26.join(os5.tmpdir(), "tendril-plan-meta-")), "get_metadata.json");
+      const tmp = path27.join(mkdtempSync2(path27.join(os6.tmpdir(), "tendril-plan-meta-")), "get_metadata.json");
       writeFileSync9(tmp, JSON.stringify(envelope));
       metadataEntries.push({ file: tmp });
     } catch (err) {
@@ -7671,7 +7942,7 @@ function runRecordPlan(opts) {
   let metadataTruncated = false;
   for (const { file, frame } of metadataEntries) {
     try {
-      const parsed = symbolsFromMetadataEnvelope(path26.resolve(file), frame);
+      const parsed = symbolsFromMetadataEnvelope(path27.resolve(file), frame);
       symbols.push(...parsed.symbols);
       if (parsed.truncated) metadataTruncated = true;
     } catch (err) {
@@ -7705,7 +7976,7 @@ function runRecordPlan(opts) {
   if (symbols.length === 0) {
     const leads = metadataEntries.flatMap(({ file }) => {
       try {
-        const env = JSON.parse(readFileSync16(path26.resolve(file), "utf8"));
+        const env = JSON.parse(readFileSync17(path27.resolve(file), "utf8"));
         return instanceLeads(env.content.map((c) => c.text ?? "").join("\n"));
       } catch {
         return [];
@@ -7779,7 +8050,7 @@ function runRecordPlan(opts) {
         // a CLI flag and the MCP surface has no parameter for it.
         decidedBy: "HUMAN ONLY \u2014 offer it, never choose it, and you cannot run it",
         text: "Record a reduced pose set (anchor + one-factor sweeps + conflict crosses) instead of the full variant matrix. This buys calls with coverage \u2014 sampling is blind to multi-axis interactions and the report discloses the poses it skipped \u2014 so only the user may accept that trade. There is no tool parameter for it; the user runs it themselves in their own terminal, before any pose is recorded.",
-        userRuns: [`rm ${quoteArg(path26.join(opts.setDir, "recording-set.json"))}`, `${tendrilCommand(`record plan --set ${quoteArg(opts.setDir)} --component ${quoteArg(manifest.component)}`)} --sample`]
+        userRuns: [`rm ${quoteArg(path27.join(opts.setDir, "recording-set.json"))}`, `${tendrilCommand(`record plan --set ${quoteArg(opts.setDir)} --component ${quoteArg(manifest.component)}`)} --sample`]
       },
       {
         id: "larger-allowance",
@@ -7906,10 +8177,11 @@ function nextPayload(setDir) {
   const instruction = nextInstruction(setDir);
   const status = sessionStatus(setDir);
   const progress = { recordedReps: status.reps.filter((x) => x.missing.length === 0).length, totalReps: status.reps.length };
-  if (instruction === null && !existsSync20(path26.join(setDir, "get_variable_defs.json"))) {
+  if (instruction === null && !status.setTokenMapRecorded) {
     const manifest = loadManifest(setDir);
     const frameNode = Object.keys(manifest.sourceFrames ?? {})[0] ?? manifest.reps[0]?.nodeId ?? "";
-    return { slug: "__set__", nodeId: frameNode, tool: "get_variable_defs", note: `SET-LEVEL: call get_variable_defs on the component frame and ingest with --rep __set__. ${ENVELOPE_HELP}`, progress };
+    const invalidNote = status.setTokenMapInvalid !== void 0 ? ` (the existing set-level file is UNUSABLE \u2014 ${status.setTokenMapInvalid} \u2014 re-record it)` : "";
+    return { slug: "__set__", nodeId: frameNode, tool: "get_variable_defs", note: `SET-LEVEL: call get_variable_defs on the component frame and ingest with --rep __set__.${invalidNote} ${ENVELOPE_HELP}`, progress };
   }
   return instruction === null ? { complete: true, progress } : {
     ...instruction,
@@ -7929,13 +8201,13 @@ function runRecordNext(opts) {
   const payload = nextPayload(opts.setDir);
   emitData(opts, payload, () => {
     if (payload["complete"] === true) {
-      process.stdout.write("set complete \u2014 every planned rep has its required envelopes\n");
+      process.stdout.write("set complete \u2014 every planned rep has its required envelopes, all usable, and the set-level token map is recorded\n");
       return;
     }
     const progress = payload["progress"];
     process.stdout.write(`[${progress.recordedReps}/${progress.totalReps} reps] ${payload["tool"]} for ${payload["slug"]} (node ${payload["nodeId"]})
   \u2192 ${payload["note"]}
-  \u2192 then: ${tendrilCommand(`record ingest --set ${path26.resolve(opts.setDir)} --rep ${payload["slug"]} --tool ${payload["tool"]} --file <envelope.json>`)}
+  \u2192 then: ${tendrilCommand(`record ingest --set ${path27.resolve(opts.setDir)} --rep ${payload["slug"]} --tool ${payload["tool"]} --file <envelope.json>`)}
 `);
   });
 }
@@ -8009,7 +8281,7 @@ async function autoFetchAssets(setDir, rep, envelopeText2) {
   const skipped = [];
   const failed = [];
   for (const { url, name } of assetUrlsFromEnvelopeText(envelopeText2)) {
-    if (existsSync20(path26.join(setDir, rep, name))) {
+    if (existsSync21(path27.join(setDir, rep, name))) {
       skipped.push(name);
       continue;
     }
@@ -8031,16 +8303,16 @@ async function autoFetchAssets(setDir, rep, envelopeText2) {
 }
 function rawEnvelopeFromFile(file, parts) {
   if (parts) {
-    const blocks = JSON.parse(readFileSync16(path26.resolve(file), "utf8"));
+    const blocks = JSON.parse(readFileSync17(path27.resolve(file), "utf8"));
     if (!Array.isArray(blocks) || blocks.length === 0 || blocks.some((p) => typeof p !== "string")) throw new Error("parts file must be a non-empty JSON array of strings");
     return { content: blocks.map((text) => ({ type: "text", text })) };
   }
-  return { content: [{ type: "text", text: readFileSync16(path26.resolve(file), "utf8") }] };
+  return { content: [{ type: "text", text: readFileSync17(path27.resolve(file), "utf8") }] };
 }
 async function runRecordIngest(opts) {
   let payload;
   try {
-    payload = opts.rawParts === true || opts.raw === true ? rawEnvelopeFromFile(opts.file, opts.rawParts === true) : JSON.parse(readFileSync16(path26.resolve(opts.file), "utf8"));
+    payload = opts.rawParts === true || opts.raw === true ? rawEnvelopeFromFile(opts.file, opts.rawParts === true) : JSON.parse(readFileSync17(path27.resolve(opts.file), "utf8"));
   } catch (err) {
     fail(opts, ExitCode.InputValidation, {
       error: `cannot read envelope file: ${err instanceof Error ? err.message : String(err)}`,
@@ -8052,7 +8324,7 @@ async function runRecordIngest(opts) {
     fail(opts, ExitCode.InputValidation, {
       error: "--raw is for text tool responses; screenshots are binary",
       code: "envelope-invalid",
-      remediation: `Use \`${tendrilCommand(`record fetch --set ${path26.resolve(opts.setDir)} --rep ${opts.rep} --tool ${opts.tool} --url <image_url>`)}\` instead.`
+      remediation: `Use \`${tendrilCommand(`record fetch --set ${path27.resolve(opts.setDir)} --rep ${opts.rep} --tool ${opts.tool} --url <image_url>`)}\` instead.`
     });
   }
   if (opts.rep === "__set__" && opts.tool === "get_variable_defs") {
@@ -8072,7 +8344,7 @@ async function runRecordIngest(opts) {
         remediation: REINGEST_GUIDANCE
       });
     }
-    writeFileSync9(path26.join(opts.setDir, "get_variable_defs.json"), `${JSON.stringify(payload, null, 1)}
+    writeFileSync9(path27.join(opts.setDir, "get_variable_defs.json"), `${JSON.stringify(payload, null, 1)}
 `);
     emitData(opts, { ingested: "get_variable_defs", rep: "__set__", setLevel: true, next: nextPayload(opts.setDir) }, () => {
       process.stdout.write("set-level get_variable_defs ingested\n");
@@ -8088,7 +8360,7 @@ async function runRecordIngest(opts) {
       if (assets !== void 0) {
         for (const a of assets.fetched) process.stdout.write(`  asset fetched ${a}
 `);
-        for (const f of assets.failed) process.stdout.write(`  ASSET FAILED ${f.name}: ${f.reason} \u2014 download it, then: ${tendrilCommand(`record asset --set ${path26.resolve(opts.setDir)} --rep ${opts.rep} --name ${f.name} --file <downloaded-file>`)}
+        for (const f of assets.failed) process.stdout.write(`  ASSET FAILED ${f.name}: ${f.reason} \u2014 download it, then: ${tendrilCommand(`record asset --set ${path27.resolve(opts.setDir)} --rep ${opts.rep} --name ${f.name} --file <downloaded-file>`)}
 `);
       }
     });
@@ -8161,15 +8433,15 @@ async function runRecordIngestRep(opts) {
     if (assets !== void 0) {
       for (const a of assets.fetched) process.stdout.write(`  asset fetched ${a}
 `);
-      for (const f of assets.failed) process.stdout.write(`  ASSET FAILED ${f.name}: ${f.reason} \u2014 download it, then: ${tendrilCommand(`record asset --set ${path26.resolve(opts.setDir)} --rep ${opts.rep} --name ${f.name} --file <downloaded-file>`)}
+      for (const f of assets.failed) process.stdout.write(`  ASSET FAILED ${f.name}: ${f.reason} \u2014 download it, then: ${tendrilCommand(`record asset --set ${path27.resolve(opts.setDir)} --rep ${opts.rep} --name ${f.name} --file <downloaded-file>`)}
 `);
     }
   });
 }
 function runRecordAsset(opts) {
   if (opts.dir !== void 0) {
-    const dir = path26.resolve(opts.dir);
-    const names = readdirSync5(dir).filter((f) => /^asset-[\w.-]+\.(svg|png|jpe?g|webp|gif)$/i.test(f));
+    const dir = path27.resolve(opts.dir);
+    const names = readdirSync6(dir).filter((f) => /^asset-[\w.-]+\.(svg|png|jpe?g|webp|gif)$/i.test(f));
     if (names.length === 0) {
       fail(opts, ExitCode.InputValidation, {
         error: `no asset-*.<ext> files found in ${dir}`,
@@ -8180,7 +8452,7 @@ function runRecordAsset(opts) {
     const ingested = [];
     try {
       for (const name of names) {
-        ingestAsset(opts.setDir, opts.rep, name, readFileSync16(path26.join(dir, name)));
+        ingestAsset(opts.setDir, opts.rep, name, readFileSync17(path27.join(dir, name)));
         ingested.push(name);
       }
     } catch (err) {
@@ -8200,11 +8472,11 @@ function runRecordAsset(opts) {
     fail(opts, ExitCode.InputValidation, {
       error: "pass --name and --file for a single asset, or --dir for a batch",
       code: "asset-rejected",
-      remediation: tendrilCommand(`record asset --set ${path26.resolve(opts.setDir)} --rep ${opts.rep} --dir <downloads-dir>`)
+      remediation: tendrilCommand(`record asset --set ${path27.resolve(opts.setDir)} --rep ${opts.rep} --dir <downloads-dir>`)
     });
   }
   try {
-    ingestAsset(opts.setDir, opts.rep, opts.name, readFileSync16(path26.resolve(opts.file)));
+    ingestAsset(opts.setDir, opts.rep, opts.name, readFileSync17(path27.resolve(opts.file)));
     emitData(opts, { rep: opts.rep, asset: opts.name }, () => {
       process.stdout.write(`ingested ${opts.rep}/${opts.name}
 `);
@@ -8223,10 +8495,21 @@ function runRecordStatus(opts) {
     for (const r of status.reps) {
       process.stdout.write(`${r.missing.length === 0 ? "DONE " : "TODO "} ${r.slug.padEnd(24)} recorded=[${r.recorded.join(",")}]${r.missing.length > 0 ? ` missing=[${r.missing.join(",")}]` : ""}
 `);
-    }
-    process.stdout.write(status.complete ? "\nset complete\n" : `
-${status.reps.filter((r) => r.missing.length > 0).length} rep(s) pending
+      for (const inv of r.invalid ?? []) {
+        process.stdout.write(`         ${r.slug}/${inv.tool}: recorded file is UNUSABLE \u2014 ${inv.reason} (re-record this call)
 `);
+      }
+    }
+    const pending = status.reps.filter((r) => r.missing.length > 0).length;
+    process.stdout.write(
+      status.complete ? "\nset complete\n" : pending > 0 ? `
+${pending} rep(s) pending
+` : status.setTokenMapInvalid !== void 0 ? `
+all reps recorded, but the SET-LEVEL token map file is UNUSABLE (${status.setTokenMapInvalid}) \u2014 re-record it via \`record next\`
+` : `
+all reps recorded, but the SET-LEVEL token map is missing \u2014 run \`record next\` for the get_variable_defs step (without it briefs ship an empty token table)
+`
+    );
   });
 }
 function narrowedRoles(derived, override) {
@@ -8240,7 +8523,7 @@ function narrowedRoles(derived, override) {
 function rolesFromFile(opts, file, derived) {
   let json;
   try {
-    json = JSON.parse(readFileSync16(path26.resolve(file), "utf8"));
+    json = JSON.parse(readFileSync17(path27.resolve(file), "utf8"));
   } catch (err) {
     fail(opts, ExitCode.InputValidation, {
       error: `cannot read roles file ${file}: ${err instanceof Error ? err.message.split("\n")[0] : String(err)}`,
@@ -8278,11 +8561,11 @@ function rolesFromFile(opts, file, derived) {
   };
 }
 function runRecordFinish(opts) {
-  if (!existsSync20(path26.join(opts.setDir, "recording-set.json"))) {
+  if (!existsSync21(path27.join(opts.setDir, "recording-set.json"))) {
     fail(opts, ExitCode.InputValidation, {
       error: `no recording-set.json in ${opts.setDir}`,
       code: "no-recording-set",
-      remediation: `Run \`${tendrilCommand(`record plan --set ${path26.resolve(opts.setDir)} --component <name> --metadata <envelope.json>`)}\` first \u2014 \`record finish\` closes a set the planner opened.`
+      remediation: `Run \`${tendrilCommand(`record plan --set ${path27.resolve(opts.setDir)} --component <name> --metadata <envelope.json>`)}\` first \u2014 \`record finish\` closes a set the planner opened.`
     });
   }
   const { manifest, raw } = readManifestFile(opts.setDir);
@@ -8310,17 +8593,17 @@ function runRecordFinish(opts) {
     fail(opts, ExitCode.ConfirmationRequired, {
       error: "--confirm-roles (and --roles-file) require an interactive terminal \u2014 this confirmation is human-only",
       code: "roles-confirmation-not-interactive",
-      remediation: `A human runs \`${tendrilCommand(`record finish --set ${path26.resolve(opts.setDir)} --confirm-roles`)}\` in their own terminal. Agents: show the proposal to your operator instead of confirming it.`
+      remediation: `A human runs \`${tendrilCommand(`record finish --set ${path27.resolve(opts.setDir)} --confirm-roles`)}\` in their own terminal. Agents: show the proposal to your operator instead of confirming it.`
     });
   }
   const merged = { ...raw, roles };
-  const { issues } = validateRecordingSet(merged, (rel) => existsSync20(path26.join(opts.setDir, rel)));
+  const { issues } = validateRecordingSet(merged, (rel) => existsSync21(path27.join(opts.setDir, rel)));
   const errors = issues.filter((i) => i.severity === "error");
   if (errors.length > 0) {
     fail(opts, ExitCode.InputValidation, {
       error: `recording set rejected \u2014 roles NOT written: ${errors.map((e) => e.message).join("; ")}`,
       code: "recording-set-invalid",
-      remediation: `Fix the set (\`${tendrilCommand(`record status --set ${path26.resolve(opts.setDir)}`)}\` lists missing envelopes) or the roles graph, then re-run \`record finish\`.`
+      remediation: `Fix the set (\`${tendrilCommand(`record status --set ${path27.resolve(opts.setDir)}`)}\` lists missing envelopes) or the roles graph, then re-run \`record finish\`.`
     });
   }
   for (const issue of issues) if (issue.severity === "warning") warn(opts, issue.message);
@@ -8554,8 +8837,8 @@ var init_engine_curated = __esm({
 });
 
 // packages/generate/src/loop.ts
-import { existsSync as existsSync21, mkdirSync as mkdirSync6, readFileSync as readFileSync17, renameSync, writeFileSync as writeFileSync10 } from "node:fs";
-import path27 from "node:path";
+import { existsSync as existsSync22, mkdirSync as mkdirSync6, readFileSync as readFileSync18, renameSync, writeFileSync as writeFileSync10 } from "node:fs";
+import path28 from "node:path";
 import { z as z11 } from "zod";
 function objective(scores, behaviors) {
   const vals = scores.map((s) => Math.min(s.similarity, s.inkRecall));
@@ -8592,9 +8875,9 @@ ${absentLines.join("\n")}` : ""}
 Fix the FAIL configs (region coordinates are in the recorded screenshot's frame; ink<1 means recorded foreground pixels your render does not cover). Reading the pair: ink credits a recorded pixel when ANY render ink lands within 1px of it, so ink=1 proves coverage \u2014 not presence, shape, or colour. A wrong-shaped mark over the right region, or a wrong-coloured one that is still ink, scores 1.000; and a recorded mark within ~30 channel-sum of the backdrop (#f6f6f6 on white is 27) is not ink at all, so it can be absent at ink 1.000 with no MISSING line. With ink=1 AND low sim, coverage held while pixels differ, so start with the TWO causes below \u2014 but never read ink=1 as "nothing is missing": confirm every faint or small recorded mark (hairlines, dividers, low-contrast controls) exists in your render. GEOMETRY: wrong position/size/radius; the diff shows shifted edges and bands. WRONG TEXT WEIGHT OR FACE: the diff shows a uniform haze over glyph runs; CSS binds the font FAMILY before the weight, a later family in the stack is never consulted for a weight the first one lacks, and font-synthesis: none rules out faux-bold \u2014 so a stack led by a family the kit holds at one weight renders every other weight in that face, silently. Check the font stack against the kit's cached faces before concluding geometry is at fault. LOW ink with high sim means recorded marks are absent or painted invisibly. Do not regress PASS configs. ${mode === "files" ? "Update the files in your candidate directory and re-run the score." : "Reply with the complete corrected files in the same FILE format."}`;
 }
 function archivePriorRun(outDir) {
-  if (!existsSync21(path27.join(outDir, "run-log.json")) && !existsSync21(path27.join(outDir, "loop-state.json"))) return void 0;
+  if (!existsSync22(path28.join(outDir, "run-log.json")) && !existsSync22(path28.join(outDir, "loop-state.json"))) return void 0;
   let n = 1;
-  while (existsSync21(`${outDir}-prev-${n}`)) n += 1;
+  while (existsSync22(`${outDir}-prev-${n}`)) n += 1;
   renameSync(outDir, `${outDir}-prev-${n}`);
   return `${outDir}-prev-${n}`;
 }
@@ -8603,14 +8886,14 @@ async function runEngineLoop(opts) {
   const plateau = opts.plateau ?? 2;
   const progress = opts.onProgress ?? (() => {
   });
-  const statePath = path27.join(opts.outDir, "loop-state.json");
-  const resuming = opts.resume === true && existsSync21(statePath);
+  const statePath = path28.join(opts.outDir, "loop-state.json");
+  const resuming = opts.resume === true && existsSync22(statePath);
   if (!resuming) {
     const archived = archivePriorRun(opts.outDir);
     if (archived !== void 0) progress(`previous run archived to ${archived}`);
   }
   mkdirSync6(opts.outDir, { recursive: true });
-  const scratch = path27.join(opts.outDir, ".candidate");
+  const scratch = path28.join(opts.outDir, ".candidate");
   let attempts = [];
   let log = [];
   let best;
@@ -8618,7 +8901,7 @@ async function runEngineLoop(opts) {
   let nonAccepted = 0;
   let stopReason = "max-iterations";
   if (resuming) {
-    const restored = LoopStateSchema.parse(JSON.parse(readFileSync17(statePath, "utf8")));
+    const restored = LoopStateSchema.parse(JSON.parse(readFileSync18(statePath, "utf8")));
     attempts = restored.attempts;
     log = restored.iterations;
     spentUsd = restored.spentUsd;
@@ -8638,7 +8921,7 @@ async function runEngineLoop(opts) {
   };
   const writeCandidate = (files) => {
     mkdirSync6(scratch, { recursive: true });
-    for (const [name, content] of Object.entries(files)) writeFileSync10(path27.join(scratch, name), content);
+    for (const [name, content] of Object.entries(files)) writeFileSync10(path28.join(scratch, name), content);
   };
   const scoreCandidate = async (candidate, iter, usd, modelMs) => {
     writeCandidate(candidate.files);
@@ -8696,8 +8979,8 @@ async function runEngineLoop(opts) {
       const usd = candidate.usage?.usd ?? 0;
       spentUsd += usd;
       if (candidate.raw !== void 0) {
-        mkdirSync6(path27.join(opts.outDir, "responses"), { recursive: true });
-        writeFileSync10(path27.join(opts.outDir, "responses", `iter-${iter}.md`), candidate.raw);
+        mkdirSync6(path28.join(opts.outDir, "responses"), { recursive: true });
+        writeFileSync10(path28.join(opts.outDir, "responses", `iter-${iter}.md`), candidate.raw);
       }
       if (candidate.files[opts.entry] === void 0 || candidate.files["styles.css"] === void 0) {
         const finish = candidate.usage?.finishReason ?? "?";
@@ -8723,10 +9006,10 @@ async function runEngineLoop(opts) {
       }
     }
   }
-  if (best !== void 0) for (const [name, content] of Object.entries(best.files)) writeFileSync10(path27.join(opts.outDir, name), content);
+  if (best !== void 0) for (const [name, content] of Object.entries(best.files)) writeFileSync10(path28.join(opts.outDir, name), content);
   const final = best !== void 0 ? await opts.score(opts.outDir) : { scores: [], behaviors: [] };
   writeFileSync10(
-    path27.join(opts.outDir, "run-log.json"),
+    path28.join(opts.outDir, "run-log.json"),
     `${JSON.stringify(
       {
         ...opts.meta,
@@ -8793,8 +9076,8 @@ var init_loop2 = __esm({
 });
 
 // packages/generate/src/brief.ts
-import { existsSync as existsSync22, readFileSync as readFileSync18 } from "node:fs";
-import path28 from "node:path";
+import { existsSync as existsSync23, readFileSync as readFileSync19 } from "node:fs";
+import path29 from "node:path";
 function singleAxes2(name) {
   const parsed = parseVariantAxes(name);
   if (parsed === void 0) return void 0;
@@ -9035,12 +9318,15 @@ function authorBehaviors(api, extras = {}) {
   return { behaviors, prelude: { controls: interactive ? ["> *"] : [], textInputs: [] }, disclosures };
 }
 function envelopeText(file) {
-  return envelopeFirstTextPart(JSON.parse(readFileSync18(file, "utf8")));
+  return envelopeFirstTextPart(JSON.parse(readFileSync19(file, "utf8")));
+}
+function metadataText(file) {
+  return envelopeTextContent(JSON.parse(readFileSync19(file, "utf8")));
 }
 function dismissEvidence(setDir, repSlugs) {
   for (const slug of repSlugs) {
-    const f = path28.join(setDir, slug, "get_design_context.json");
-    if (!existsSync22(f)) continue;
+    const f = path29.join(setDir, slug, "get_design_context.json");
+    if (!existsSync23(f)) continue;
     const text = envelopeText(f);
     const propHit = /[{,]\s*(\w*dismiss\w*)\s*=\s*(?:true|false)\b/i.exec(text) ?? /\b(\w*dismiss\w*)\??\s*:\s*boolean\b/i.exec(text);
     if (propHit !== null) return `emission prop "${propHit[1]}"`;
@@ -9084,13 +9370,13 @@ function recordedFontNeeds(setDir, opts = {}) {
     }
   };
   const manifest = loadManifest(setDir);
-  const setDefs = path28.join(setDir, "get_variable_defs.json");
-  if (existsSync22(setDefs)) fromDefs(envelopeText(setDefs));
+  const setDefs = path29.join(setDir, "get_variable_defs.json");
+  if (existsSync23(setDefs)) fromDefs(envelopeText(setDefs));
   for (const rep of manifest.reps) {
-    const ctx = path28.join(setDir, rep.slug, "get_design_context.json");
-    if (existsSync22(ctx)) fromEmission(envelopeText(ctx));
-    const defs = path28.join(setDir, rep.slug, "get_variable_defs.json");
-    if (existsSync22(defs)) fromDefs(envelopeText(defs));
+    const ctx = path29.join(setDir, rep.slug, "get_design_context.json");
+    if (existsSync23(ctx)) fromEmission(envelopeText(ctx));
+    const defs = path29.join(setDir, rep.slug, "get_variable_defs.json");
+    if (existsSync23(defs)) fromDefs(envelopeText(defs));
   }
   return [...byFamily.entries()].map(([family, paired]) => {
     const weights = /* @__PURE__ */ new Set([...paired, ...opts.pairedOnly === true ? [] : unpaired]);
@@ -9101,10 +9387,10 @@ function symbolFontGlyphCount(setDir, reps) {
   const PUA = /[\uE000-\uF8FF\u{F0000}-\u{FFFFD}\u{100000}-\u{10FFFD}]/u;
   const glyphs = /* @__PURE__ */ new Set();
   for (const rep of reps) {
-    const file = path28.join(setDir, rep, "get_metadata.json");
-    if (!existsSync22(file)) continue;
+    const file = path29.join(setDir, rep, "get_metadata.json");
+    if (!existsSync23(file)) continue;
     try {
-      const text = JSON.parse(readFileSync18(file, "utf8")).content.map((c) => c.text ?? "").join("\n");
+      const text = JSON.parse(readFileSync19(file, "utf8")).content.map((c) => c.text ?? "").join("\n");
       for (const m of text.matchAll(/<text\s[^>]*name="([^"]*)"/g)) {
         const name = decodeXmlEntities(m[1]).replace(/&#x([0-9a-fA-F]+);/g, (_, h) => String.fromCodePoint(parseInt(h, 16))).replace(/&#(\d+);/g, (_, d) => String.fromCodePoint(Number(d)));
         if (PUA.test(name)) glyphs.add(name);
@@ -9130,8 +9416,8 @@ function recordedTextSlots(setDir, repSlugs) {
   const propRep = [];
   const perRep = [];
   for (const slug of repSlugs) {
-    const f = path28.join(setDir, slug, "get_design_context.json");
-    if (!existsSync22(f)) continue;
+    const f = path29.join(setDir, slug, "get_design_context.json");
+    if (!existsSync23(f)) continue;
     const code = envelopeText(f);
     const props = /* @__PURE__ */ new Map();
     for (const m of code.matchAll(/[{,]\s*(\w+)\s*=\s*"((?:[^"\\]|\\.)*)"/g)) {
@@ -9156,9 +9442,9 @@ function recordedTextSlots(setDir, repSlugs) {
   }
   const axisValuesBySlug = /* @__PURE__ */ new Map();
   for (const slug of repSlugs) {
-    const metaFile = path28.join(setDir, slug, "get_metadata.json");
-    if (!existsSync22(metaFile)) continue;
-    const name = symbolName(envelopeText(metaFile));
+    const metaFile = path29.join(setDir, slug, "get_metadata.json");
+    if (!existsSync23(metaFile)) continue;
+    const name = symbolName(metadataText(metaFile));
     if (name === void 0) continue;
     const values = /* @__PURE__ */ new Set();
     for (const part of name.split(",")) {
@@ -9256,12 +9542,12 @@ function authorTaskFromSet(setDir, opts = {}) {
   const poses = [];
   const missing = [];
   for (const rep of manifest.reps) {
-    const metaFile = path28.join(setDir, rep.slug, "get_metadata.json");
-    if (!existsSync22(metaFile)) {
+    const metaFile = path29.join(setDir, rep.slug, "get_metadata.json");
+    if (!existsSync23(metaFile)) {
       missing.push(rep.slug);
       continue;
     }
-    const name = symbolName(envelopeText(metaFile));
+    const name = symbolName(metadataText(metaFile));
     if (name === void 0) {
       missing.push(rep.slug);
       continue;
@@ -9271,8 +9557,8 @@ function authorTaskFromSet(setDir, opts = {}) {
   if (missing.length > 0) {
     throw new Error(`recording set ${setDir} is missing metadata for ${missing.length} rep(s): ${missing.slice(0, 5).join(", ")}${missing.length > 5 ? ", \u2026" : ""}`);
   }
-  const setMeta = path28.join(setDir, "get_metadata.json");
-  const latticeNames = manifest.latticeNames ?? (existsSync22(setMeta) ? [...envelopeText(setMeta).matchAll(/name="([^"]*)"/g)].map((m) => decodeXmlEntities(m[1])) : void 0);
+  const setMeta = path29.join(setDir, "get_metadata.json");
+  const latticeNames = manifest.latticeNames ?? (existsSync23(setMeta) ? [...metadataText(setMeta).matchAll(/name="([^"]*)"/g)].map((m) => decodeXmlEntities(m[1])) : void 0);
   const defaults = { ...manifest.defaults ?? {}, ...opts.defaults ?? {} };
   const recordedFonts = recordedFontFamilies(setDir);
   const textSlots = recordedTextSlots(setDir, manifest.reps.map((r) => r.slug));
@@ -9455,10 +9741,10 @@ var init_brief = __esm({
 });
 
 // packages/generate/src/segments.ts
-import { existsSync as existsSync23, readFileSync as readFileSync19, readdirSync as readdirSync6 } from "node:fs";
-import path29 from "node:path";
+import { existsSync as existsSync24, readFileSync as readFileSync20, readdirSync as readdirSync7 } from "node:fs";
+import path30 from "node:path";
 function repText(set, rep, tool) {
-  const env = JSON.parse(readFileSync19(path29.join(set, rep, `${tool}.json`), "utf8"));
+  const env = JSON.parse(readFileSync20(path30.join(set, rep, `${tool}.json`), "utf8"));
   return tool === "get_design_context" ? envelopeFirstTextPart(env) : envelopeTextContent(env);
 }
 function stripFigmaInstructions(emission) {
@@ -9518,18 +9804,20 @@ DROPPED from the map, untrustworthy in the source export \u2014 for these, each
 }
 function buildSegments(task, mode = "fenced") {
   const SET = task.set;
+  let defsRecorded = existsSync24(path30.join(SET, "get_variable_defs.json"));
   let rawDefs = {};
-  if (existsSync23(path29.join(SET, "get_variable_defs.json"))) {
-    const text = envelopeFirstTextPart(JSON.parse(readFileSync19(path29.join(SET, "get_variable_defs.json"), "utf8"))) || "{}";
+  if (existsSync24(path30.join(SET, "get_variable_defs.json"))) {
+    const text = envelopeFirstTextPart(JSON.parse(readFileSync20(path30.join(SET, "get_variable_defs.json"), "utf8"))) || "{}";
     try {
       rawDefs = JSON.parse(text);
     } catch {
     }
   } else {
     for (const cfg of task.configs) {
-      const f = path29.join(SET, cfg.rep, "get_variable_defs.json");
-      if (!existsSync23(f)) continue;
-      const text = envelopeFirstTextPart(JSON.parse(readFileSync19(f, "utf8"))) || "{}";
+      const f = path30.join(SET, cfg.rep, "get_variable_defs.json");
+      if (!existsSync24(f)) continue;
+      defsRecorded = true;
+      const text = envelopeFirstTextPart(JSON.parse(readFileSync20(f, "utf8"))) || "{}";
       try {
         for (const [k, v] of Object.entries(JSON.parse(text))) rawDefs[k] ??= v;
       } catch {
@@ -9537,25 +9825,27 @@ function buildSegments(task, mode = "fenced") {
     }
   }
   const emissionTexts = task.configs.map((cfg) => {
-    const f = path29.join(SET, cfg.rep, "get_design_context.json");
-    return existsSync23(f) ? envelopeFirstTextPart(JSON.parse(readFileSync19(f, "utf8"))) : "";
+    const f = path30.join(SET, cfg.rep, "get_design_context.json");
+    return existsSync24(f) ? envelopeFirstTextPart(JSON.parse(readFileSync20(f, "utf8"))) : "";
   });
   const { map, note } = cleanTokenMap(rawDefs, emissionTexts);
   const defs = JSON.stringify(map, null, 1);
   const parts = [
     "Implement the component family below. For each recorded config: the symbol box, Figma's emission (intent \u2014 write your own clean implementation; emissions are VERBATIM Figma output and may contain non-compiling artifacts like duplicate consts \u2014 never copy them as code), and its SVG assets (inline these; network is denied at render).",
-    `
+    defsRecorded ? `
 ## Design tokens (use these CSS custom property names)
 \`\`\`json
 ${defs}
-\`\`\`${note}`
+\`\`\`${note}` : `
+## Design tokens
+TOKEN MAP NEVER RECORDED: this set holds no get_variable_defs envelope, so whether the kit exposes tokens is UNKNOWN \u2014 not answered. Literal values are your only option here and are correct to use; do NOT invent token names. (The set can record the map later: \`record next\` asks for get_variable_defs once, at set level.)${note}`
   ];
   for (const cfg of task.configs) {
     const meta = stripFigmaInstructions(repText(SET, cfg.rep, "get_metadata"));
     const emission = stripFigmaInstructions(repText(SET, cfg.rep, "get_design_context"));
-    const assets = readdirSync6(path29.join(SET, cfg.rep)).filter((f) => f.startsWith("asset-") && f.endsWith(".svg")).map((f) => `asset ${f}:
+    const assets = readdirSync7(path30.join(SET, cfg.rep)).filter((f) => f.startsWith("asset-") && f.endsWith(".svg")).map((f) => `asset ${f}:
 \`\`\`svg
-${readFileSync19(path29.join(SET, cfg.rep, f), "utf8")}
+${readFileSync20(path30.join(SET, cfg.rep, f), "utf8")}
 \`\`\``).join("\n");
     parts.push(`
 ## Config ${cfg.rep} \u2192 ${cfg.component} ${JSON.stringify(cfg.props)}
@@ -9580,7 +9870,7 @@ Optionally a third block with \`/* FILE: tokens.css */\`.`);
   } else {
     parts.push(`
 ## Output format
-Write the COMPLETE files (${task.entry}, styles.css, optional tokens.css) into ONE candidate directory: \`tendril-out/${path29.basename(task.set)}-candidate/\` unless you were handed another path. Pass that same directory to \`tendril engine score\` every round and keep writing into it \u2014 the scorer stamps the bundle there, writes its evidence beside your files, and appends its score-history.jsonl lines there (one when a round starts, one when it scores); a fresh directory each round throws all of that away. Do not paste file contents into chat \u2014 the scorer reads the directory.`);
+Write the COMPLETE files (${task.entry}, styles.css, optional tokens.css) into ONE candidate directory: \`tendril-out/${path30.basename(task.set)}-candidate/\` unless you were handed another path. Pass that same directory to \`tendril engine score\` every round and keep writing into it \u2014 the scorer stamps the bundle there, writes its evidence beside your files, and appends its score-history.jsonl lines there (one when a round starts, one when it scores); a fresh directory each round throws all of that away. Do not paste file contents into chat \u2014 the scorer reads the directory.`);
   }
   return parts.join("\n");
 }
@@ -9648,8 +9938,8 @@ var init_adapter = __esm({
 
 // packages/generate/src/bundle-emit.ts
 import { createHash as createHash4 } from "node:crypto";
-import { copyFileSync, existsSync as existsSync24, mkdirSync as mkdirSync7, readFileSync as readFileSync20, readdirSync as readdirSync7, rmSync as rmSync3, writeFileSync as writeFileSync11 } from "node:fs";
-import path30 from "node:path";
+import { copyFileSync, existsSync as existsSync25, mkdirSync as mkdirSync7, readFileSync as readFileSync21, readdirSync as readdirSync8, rmSync as rmSync3, writeFileSync as writeFileSync11 } from "node:fs";
+import path31 from "node:path";
 function pinFromConfigs(configs) {
   const domains = /* @__PURE__ */ new Map();
   const kinds = /* @__PURE__ */ new Map();
@@ -9718,15 +10008,23 @@ function fontsCssFor(faces, bundleDir, cacheDir = DEFAULT_FONT_CACHE, substitute
   const notices = [];
   const licenseTexts = /* @__PURE__ */ new Map();
   for (const face of faces) {
-    const src = path30.join(cacheDir, path30.basename(face.file));
-    const target = `./fonts/${path30.basename(face.file)}`;
-    const format = FONT_FORMATS[path30.extname(face.file).toLowerCase()] ?? "truetype";
+    const src = path31.join(cacheDir, path31.basename(face.file));
+    const target = `./fonts/${path31.basename(face.file)}`;
+    const format = FONT_FORMATS[path31.extname(face.file).toLowerCase()] ?? "truetype";
     const family = face.family.replace(/['\\]/g, "").replace(/\*\//g, "");
     const decl = `@font-face { font-family: '${family}'; font-weight: ${face.weight}; font-style: normal; src: url(${target}) format('${format}'); }`;
     const license = normalizeFontLicense(face.license);
-    const terms = REDISTRIBUTABLE.get(license);
+    const terms = face.source.startsWith("system:") || face.source.startsWith("local:") ? void 0 : REDISTRIBUTABLE.get(license);
     if (terms === void 0) {
-      if (face.source.startsWith("local:")) {
+      if (face.source.startsWith("system:")) {
+        lines.push(
+          `/* '${family}' ${face.weight} came from this machine's installed system fonts (tendril fonts`,
+          `   add-system; sha256 ${face.sha256.slice(0, 16)}\u2026). OS-bundled faces are never copied into`,
+          "   bundles regardless of any recorded licence \u2014 the consuming machine provides its own copy,",
+          `   or you place one you licence at ${target} and uncomment: */`,
+          `/* ${decl} */`
+        );
+      } else if (face.source.startsWith("local:")) {
         lines.push(
           `/* '${family}' ${face.weight} is a user-licensed face (tendril fonts add; sha256 ${face.sha256.slice(0, 16)}\u2026).`,
           `   Licensed bytes are never copied into bundles \u2014 place your copy at ${target} and uncomment: */`,
@@ -9750,14 +10048,14 @@ function fontsCssFor(faces, bundleDir, cacheDir = DEFAULT_FONT_CACHE, substitute
           `/* ${decl} */`
         );
       }
-    } else if (existsSync24(src) && createHash4("sha256").update(readFileSync20(src)).digest("hex") === face.sha256) {
-      mkdirSync7(path30.join(bundleDir, "fonts"), { recursive: true });
-      copyFileSync(src, path30.join(bundleDir, "fonts", path30.basename(face.file)));
+    } else if (existsSync25(src) && createHash4("sha256").update(readFileSync21(src)).digest("hex") === face.sha256) {
+      mkdirSync7(path31.join(bundleDir, "fonts"), { recursive: true });
+      copyFileSync(src, path31.join(bundleDir, "fonts", path31.basename(face.file)));
       licenseTexts.set(terms.file, terms.text);
       const upstream = upstreamAttribution(face);
       notices.push(
         "",
-        `${face.family.replace(/[\r\n]+/g, " ")} ${face.weight} \u2014 ./${path30.basename(face.file)}`,
+        `${face.family.replace(/[\r\n]+/g, " ")} ${face.weight} \u2014 ./${path31.basename(face.file)}`,
         `  licence:   ${terms.title} \u2014 full text in ./${terms.file}`,
         `  source:    ${face.source}`,
         `  sha256:    ${face.sha256}`,
@@ -9771,9 +10069,9 @@ function fontsCssFor(faces, bundleDir, cacheDir = DEFAULT_FONT_CACHE, substitute
   }
   if (lines.length === 0) return null;
   if (notices.length > 0) {
-    const fontsDir = path30.join(bundleDir, "fonts");
-    for (const [file, text] of licenseTexts) writeFileSync11(path30.join(fontsDir, file), text);
-    writeFileSync11(path30.join(fontsDir, "NOTICE.txt"), `${[NOTICE_PREAMBLE, ...notices].join("\n")}
+    const fontsDir = path31.join(bundleDir, "fonts");
+    for (const [file, text] of licenseTexts) writeFileSync11(path31.join(fontsDir, file), text);
+    writeFileSync11(path31.join(fontsDir, "NOTICE.txt"), `${[NOTICE_PREAMBLE, ...notices].join("\n")}
 `);
     header.push(
       "/* REDISTRIBUTION: the face files in ./fonts/ are redistributed under the licences",
@@ -9785,10 +10083,10 @@ function fontsCssFor(faces, bundleDir, cacheDir = DEFAULT_FONT_CACHE, substitute
 `;
 }
 function countLatticeSymbols(setDir) {
-  const manifestFile = path30.join(setDir, "recording-set.json");
-  if (existsSync24(manifestFile)) {
+  const manifestFile = path31.join(setDir, "recording-set.json");
+  if (existsSync25(manifestFile)) {
     try {
-      const stored = JSON.parse(readFileSync20(manifestFile, "utf8"));
+      const stored = JSON.parse(readFileSync21(manifestFile, "utf8"));
       if (stored.variantScope !== "component-set") return null;
       const lattice = stored.latticeNames;
       if (lattice !== void 0 && lattice.length > 0) return lattice.length;
@@ -9796,13 +10094,13 @@ function countLatticeSymbols(setDir) {
     }
   }
   const files = [
-    path30.join(setDir, "get_metadata.json"),
-    ...existsSync24(setDir) ? readdirSync7(setDir).filter((f) => /^get_metadata-.*\.json$/.test(f)).map((f) => path30.join(setDir, f)) : []
-  ].filter((f) => existsSync24(f));
+    path31.join(setDir, "get_metadata.json"),
+    ...existsSync25(setDir) ? readdirSync8(setDir).filter((f) => /^get_metadata-.*\.json$/.test(f)).map((f) => path31.join(setDir, f)) : []
+  ].filter((f) => existsSync25(f));
   if (files.length === 0) return null;
   let count = 0;
   for (const f of files) {
-    const text = envelopeTextContent(JSON.parse(readFileSync20(f, "utf8")));
+    const text = envelopeTextContent(JSON.parse(readFileSync21(f, "utf8")));
     count += [...text.matchAll(/name="([^"]*)"/g)].filter((m) => m[1].includes("=")).length;
   }
   return count > 0 ? count : null;
@@ -9810,21 +10108,21 @@ function countLatticeSymbols(setDir) {
 function recordingSetHash(setDir, configs) {
   const relPaths = [];
   for (const name of ["recording-set.json", "completeness-manifest.json", "get_variable_defs.json", "get_metadata.json"]) {
-    if (existsSync24(path30.join(setDir, name))) relPaths.push(name);
+    if (existsSync25(path31.join(setDir, name))) relPaths.push(name);
   }
   for (const cfg of configs) {
     for (const f of ["get_design_context.json", "get_metadata.json", "get_screenshot.json", "get_variable_defs.json"]) {
-      if (existsSync24(path30.join(setDir, cfg.rep, f))) relPaths.push(`${cfg.rep}/${f}`);
+      if (existsSync25(path31.join(setDir, cfg.rep, f))) relPaths.push(`${cfg.rep}/${f}`);
     }
-    if (existsSync24(path30.join(setDir, cfg.rep))) {
-      for (const asset of readdirSync7(path30.join(setDir, cfg.rep)).filter((f) => f.startsWith("asset-"))) {
+    if (existsSync25(path31.join(setDir, cfg.rep))) {
+      for (const asset of readdirSync8(path31.join(setDir, cfg.rep)).filter((f) => f.startsWith("asset-"))) {
         relPaths.push(`${cfg.rep}/${asset}`);
       }
     }
   }
   return hashRecordingSet(
     relPaths,
-    (p) => new Uint8Array(readFileSync20(path30.join(setDir, p))),
+    (p) => new Uint8Array(readFileSync21(path31.join(setDir, p))),
     (chunks) => {
       const h = createHash4("sha256");
       for (const c of chunks) h.update(c);
@@ -9845,10 +10143,11 @@ function emitBundleV1(opts) {
   const certified = statuses.filter((s) => s.status === "certified").length;
   const pass = statuses.filter((s) => s.status !== "fail").length;
   const lattice = countLatticeSymbols(opts.task.set);
-  const interaction = opts.behaviors.filter((b) => !b.id.startsWith("prelude:"));
+  const interaction = opts.behaviors.filter((b) => !b.id.startsWith("prelude:") && !b.id.startsWith("parity:"));
   const prelude = opts.behaviors.filter((b) => b.id.startsWith("prelude:"));
-  const cssFiles = ["styles.css", "tokens.css"].map((f) => path30.join(opts.bundleDir, f)).filter((f) => existsSync24(f));
-  const families = cssFontFamilies(cssFiles.map((f) => readFileSync20(f, "utf8")).join("\n"));
+  const parity = opts.behaviors.filter((b) => b.id.startsWith("parity:"));
+  const cssFiles = ["styles.css", "tokens.css"].map((f) => path31.join(opts.bundleDir, f)).filter((f) => existsSync25(f));
+  const families = cssFontFamilies(cssFiles.map((f) => readFileSync21(f, "utf8")).join("\n"));
   const requiredFonts = requiredFontsManifest(families, opts.fontCacheDir).map((f) => ({
     family: f.family,
     weight: f.weight,
@@ -9877,7 +10176,7 @@ function emitBundleV1(opts) {
         // resolvable via verify's --set override).
         path: (() => {
           const base = process.env["INIT_CWD"] ?? process.cwd();
-          const rel = path30.relative(base, opts.task.set);
+          const rel = path31.relative(base, opts.task.set);
           return rel !== "" && !rel.startsWith("..") ? rel : opts.task.set;
         })(),
         component: opts.componentName,
@@ -9901,21 +10200,21 @@ function emitBundleV1(opts) {
     })
   };
   const written = [];
-  const manifestPath2 = path30.join(opts.bundleDir, "component.json");
+  const manifestPath2 = path31.join(opts.bundleDir, "component.json");
   writeFileSync11(manifestPath2, `${JSON.stringify(manifest, null, 2)}
 `);
   written.push(manifestPath2);
-  const stylesPath = path30.join(opts.bundleDir, "styles.css");
-  if (existsSync24(stylesPath)) {
+  const stylesPath = path31.join(opts.bundleDir, "styles.css");
+  if (existsSync25(stylesPath)) {
     const comment = cssProvenanceComment({ pass, scored: statuses.length, certified, latticeConfigs: lattice });
-    const current = readFileSync20(stylesPath, "utf8");
+    const current = readFileSync21(stylesPath, "utf8");
     const stripped = current.replace(/^\/\* tendril bundle v\d+ [^]*?\*\/\n/, "");
     writeFileSync11(stylesPath, `${comment}
 ${stripped}`);
     written.push(stylesPath);
   }
-  const fontsCssPath = path30.join(opts.bundleDir, "fonts.css");
-  rmSync3(path30.join(opts.bundleDir, "fonts"), { recursive: true, force: true });
+  const fontsCssPath = path31.join(opts.bundleDir, "fonts.css");
+  rmSync3(path31.join(opts.bundleDir, "fonts"), { recursive: true, force: true });
   rmSync3(fontsCssPath, { force: true });
   const fontsCss = fontsCssFor(requiredFontsManifest(families, opts.fontCacheDir), opts.bundleDir, opts.fontCacheDir, opts.substitutedFamilies ?? []);
   if (fontsCss !== null) {
@@ -9923,7 +10222,7 @@ ${stripped}`);
     written.push(fontsCssPath);
   }
   const unrecorded = lattice === null ? null : Math.max(0, lattice - statuses.length);
-  const statusLine = `bundle: ${pass}/${statuses.length} recorded configs \u2265 pass bar (${certified} certified), ` + (interaction.length === 0 ? "interaction behaviors NONE VERIFIED" : `interaction behaviors ${interaction.filter((b) => b.pass).length}/${interaction.length}`) + (prelude.length === 0 ? "" : `, page hygiene ${prelude.filter((b) => b.pass).length}/${prelude.length}`) + (unrecorded === null ? "" : `; ${unrecorded} lattice configs UNVERIFIED`) + ` \u2014 claims in component.json, recompute with \`tendril verify\``;
+  const statusLine = `bundle: ${pass}/${statuses.length} recorded configs \u2265 pass bar (${certified} certified), ` + (interaction.length === 0 ? "interaction behaviors NONE VERIFIED" : `interaction behaviors ${interaction.filter((b) => b.pass).length}/${interaction.length}`) + (parity.length === 0 ? "" : `, state parity ${parity.filter((b) => b.pass).length}/${parity.length}`) + (prelude.length === 0 ? "" : `, page hygiene ${prelude.filter((b) => b.pass).length}/${prelude.length}`) + (unrecorded === null ? "" : `; ${unrecorded} lattice configs UNVERIFIED`) + ` \u2014 claims in component.json, recompute with \`tendril verify\``;
   return { manifest, statusLine, written };
 }
 var FONT_FORMATS, BARS, NOTICE_PREAMBLE, OFL_1_1_TEXT, UFL_1_0_TEXT, APACHE_2_0_TEXT, REDISTRIBUTABLE;
@@ -10360,9 +10659,9 @@ var init_src7 = __esm({
 });
 
 // packages/cli/src/font-guidance.ts
-import path31 from "node:path";
+import path32 from "node:path";
 function fontsUnprovenRemediation(setDir) {
-  const set = setDir === void 0 ? void 0 : path31.resolve(setDir);
+  const set = setDir === void 0 ? void 0 : path32.resolve(setDir);
   if (set !== void 0) {
     try {
       const needs = recordedFontNeeds(set);
@@ -10430,20 +10729,28 @@ __export(fonts_exports, {
   DEFAULT_FONT_CACHE: () => DEFAULT_FONT_CACHE,
   familyMismatch: () => familyMismatch,
   runFontsAdd: () => runFontsAdd,
+  runFontsAddSystem: () => runFontsAddSystem,
+  runFontsDiscover: () => runFontsDiscover,
   runFontsRequired: () => runFontsRequired,
   runFontsResolve: () => runFontsResolve,
   runFontsResolveSet: () => runFontsResolveSet,
   runFontsStatus: () => runFontsStatus
 });
-import { existsSync as existsSync25, readFileSync as readFileSync21 } from "node:fs";
-import path32 from "node:path";
+import { existsSync as existsSync26, readFileSync as readFileSync22 } from "node:fs";
+import path33 from "node:path";
 async function runFontsResolve(opts) {
   const result = await resolveFonts(opts.family, opts.weights, opts.cacheDir);
-  emitData(opts, result, () => {
+  const queryRefusal = systemFaceRefusal(opts.family.trim());
+  emitData(opts, { ...result, ...queryRefusal !== void 0 ? { queryRefusal } : {} }, () => {
     for (const f of result.resolved) process.stdout.write(`resolved ${f.family} ${f.weight} (${f.sha256.slice(0, 12)}\u2026)
 `);
     for (const f of result.failures) process.stdout.write(`FAILED  ${f.family} ${f.weight}: ${f.reason}
 `);
+    if (queryRefusal !== void 0 && result.failures.length > 0) {
+      process.stdout.write(`        "${opts.family}" is a refusal-class family: ${queryRefusal}
+        Options: proceed under a disclosed substitute (rules out certification), or register a file you license yourself: ${tendrilCommand(`fonts add ${quoteArg(opts.family)} <weight> <file>`)} \u2014 bundles declare the face and never carry its bytes.
+`);
+    }
   });
   if (result.failures.length > 0) {
     warn(opts, `${result.failures.length} face(s) unresolved \u2014 verification will refuse to score under substitution`);
@@ -10451,7 +10758,7 @@ async function runFontsResolve(opts) {
   }
 }
 async function runFontsResolveSet(opts) {
-  const setDir = path32.resolve(process.env["INIT_CWD"] ?? process.cwd(), opts.set);
+  const setDir = path33.resolve(process.env["INIT_CWD"] ?? process.cwd(), opts.set);
   let needs = [];
   try {
     needs = recordedFontNeeds(setDir);
@@ -10501,7 +10808,8 @@ async function runFontsResolveSet(opts) {
       unlicensed.push(...result.failures);
     }
   }
-  emitData(opts, { set: setDir, needs, cached: cached2, resolved, relicensed, unlicensed, failures }, () => {
+  const refusals = [...new Set(failures.map((f) => f.family))].map((family) => ({ family, reason: systemFaceRefusal(family.trim()) })).filter((r) => r.reason !== void 0);
+  emitData(opts, { set: setDir, needs, cached: cached2, resolved, relicensed, unlicensed, failures, ...refusals.length > 0 ? { refusals } : {} }, () => {
     process.stdout.write(`set declares: ${needs.map((n) => `${n.family} (${n.weights.join(", ")})`).join(" \xB7 ")}
 `);
     for (const f of cached2) process.stdout.write(`cached   ${f.family} ${f.weight}
@@ -10514,6 +10822,15 @@ async function runFontsResolveSet(opts) {
 `);
     for (const f of failures) process.stdout.write(`FAILED   ${f.family} ${f.weight}: ${f.reason}
 `);
+    for (const fam of [...new Set(failures.map((f) => f.family))]) {
+      const refusal = systemFaceRefusal(fam);
+      process.stdout.write(
+        refusal !== void 0 ? `         "${fam}" is a refusal-class family: ${refusal}
+         Options: proceed and let the mount substitute a provided face (disclosed; rules out certification), or register a file you license yourself: ${tendrilCommand(`fonts add ${quoteArg(fam)} <weight> <file>`)} \u2014 licensing is yours to judge; bundles declare the face and never carry its bytes.
+` : `         if "${fam}" is installed on this machine: ${tendrilCommand(`fonts discover ${quoteArg(fam)}`)} then ${tendrilCommand(`fonts add-system ${quoteArg(fam)} --set ${quoteArg(setDir)}`)} (licence stays unknown; bundles declare, never copy)
+`
+      );
+    }
   });
   if (byteDrift.length > 0) {
     warn(opts, `${byteDrift.map((f) => `${f.family} ${f.weight}`).join(", ")}: the foundry now serves different bytes than the cache held \u2014 the faces were re-fetched to record their licence, so re-pin any font lock deliberately`);
@@ -10524,16 +10841,16 @@ async function runFontsResolveSet(opts) {
   }
 }
 function runFontsStatus(opts) {
-  const manifestPath2 = path32.join(opts.cacheDir, "manifest.json");
-  if (!existsSync25(manifestPath2)) {
+  const manifestPath2 = path33.join(opts.cacheDir, "manifest.json");
+  if (!existsSync26(manifestPath2)) {
     fail(opts, ExitCode.FontsUnproven, {
       error: `no font cache at ${opts.cacheDir}`,
       code: "fonts-unresolved",
       remediation: `Run \`${tendrilCommand("fonts resolve --set <recording-dir>")}\` (or \`${tendrilCommand('fonts resolve "<Family>" --weights 400 500 600')}\`) first.`
     });
   }
-  const faces = JSON.parse(readFileSync21(manifestPath2, "utf8"));
-  const lockVerdicts = opts.lock !== void 0 ? checkFontLock(path32.resolve(opts.lock), opts.cacheDir) : null;
+  const faces = JSON.parse(readFileSync22(manifestPath2, "utf8"));
+  const lockVerdicts = opts.lock !== void 0 ? checkFontLock(path33.resolve(opts.lock), opts.cacheDir) : null;
   emitData(opts, { faces, lockVerdicts }, () => {
     for (const f of faces) process.stdout.write(`cached ${f.family} ${f.weight} (${f.sha256.slice(0, 12)}\u2026)
 `);
@@ -10577,13 +10894,13 @@ function familyMismatch(family, declared) {
 }
 function runFontsAdd(opts) {
   if (opts.set !== void 0) {
-    const declared = taskFontFamilies(path32.resolve(opts.set)) ?? [];
+    const declared = taskFontFamilies(path33.resolve(opts.set)) ?? [];
     const mismatch = familyMismatch(opts.family, declared);
     if (mismatch !== void 0) {
       fail(opts, ExitCode.InputValidation, {
         error: `the recording set does not declare a family named "${opts.family}" \u2014 it declares ${declared.map((d) => `"${d}"`).join(", ")}. Adding it under this name would cache a face the mount never matches, and scoring would keep refusing for the family that is still missing.`,
         code: "font-family-not-declared",
-        remediation: mismatch.nearest !== void 0 ? `Did you mean "${mismatch.nearest}"? ${tendrilCommand(`fonts add "${mismatch.nearest}" ${opts.weight} ${opts.file} --set ${path32.resolve(opts.set)}`)}` : `Use one of the declared families exactly as the recording spells it, or drop --set to add a family this set does not declare.`
+        remediation: mismatch.nearest !== void 0 ? `Did you mean "${mismatch.nearest}"? ${tendrilCommand(`fonts add "${mismatch.nearest}" ${opts.weight} ${opts.file} --set ${path33.resolve(opts.set)}`)}` : `Use one of the declared families exactly as the recording spells it, or drop --set to add a family this set does not declare.`
       });
     }
   } else {
@@ -10610,6 +10927,81 @@ function runFontsAdd(opts) {
 `);
   });
 }
+function runFontsDiscover(opts) {
+  const faces = opts.family !== void 0 ? systemFacesForFamily(opts.family, opts.dirs) : discoverSystemFaces(opts.dirs);
+  const rows = faces.map((f) => ({ ...f, ...systemFaceRefusal(f.family) !== void 0 ? { refused: systemFaceRefusal(f.family) } : {} }));
+  const queryRefusal = opts.family !== void 0 ? systemFaceRefusal(opts.family) : void 0;
+  emitData(opts, { faces: rows, dirs: opts.dirs ?? systemFontDirs(), ...queryRefusal !== void 0 ? { queryRefusal } : {} }, () => {
+    if (rows.length === 0) {
+      process.stdout.write(`no matching system faces found (scanned: ${(opts.dirs ?? systemFontDirs()).join(", ")})
+`);
+      if (queryRefusal !== void 0) {
+        process.stdout.write(
+          `note: "${opts.family}" is a refusal-class family regardless \u2014 ${queryRefusal}
+      A file you license yourself can still be registered for local scoring: ${tendrilCommand(`fonts add ${quoteArg(opts.family ?? "")} <weight> <file>`)} \u2014 licensing is yours to judge, and bundles declare the face but never carry its bytes.
+`
+        );
+      }
+      return;
+    }
+    for (const f of rows) {
+      const flags = [f.refused !== void 0 ? "REFUSED" : "", f.italic ? "italic" : "", f.variable ? "variable" : ""].filter((x) => x !== "").join(" ");
+      process.stdout.write(`${f.family} \u2014 ${f.subfamily || "Regular"} (${f.weight})${flags === "" ? "" : ` [${flags}]`}  ${f.file}${f.faceIndex !== void 0 ? ` #${f.faceIndex}` : ""}
+`);
+    }
+    const eligible = rows.filter((f) => f.refused === void 0 && !f.italic && !f.variable);
+    if (eligible.length > 0 && opts.family !== void 0) {
+      process.stdout.write(`
+cache them: ${tendrilCommand(`fonts add-system ${quoteArg(opts.family)}`)}
+`);
+    }
+  });
+}
+function runFontsAddSystem(opts) {
+  if (opts.set !== void 0) {
+    const declared = taskFontFamilies(path33.resolve(opts.set)) ?? [];
+    const mismatch = familyMismatch(opts.family, declared);
+    if (mismatch !== void 0) {
+      fail(opts, ExitCode.InputValidation, {
+        error: `the recording set does not declare a family named "${opts.family}" \u2014 it declares ${declared.map((d) => `"${d}"`).join(", ")}. A face cached under a name the mount never matches leaves scoring refusing for the family that is still missing.`,
+        code: "font-family-not-declared",
+        remediation: mismatch.nearest !== void 0 ? `Did you mean "${mismatch.nearest}"? ${tendrilCommand(`fonts add-system ${quoteArg(mismatch.nearest)} --set ${quoteArg(path33.resolve(opts.set))}`)}` : `Use one of the declared families exactly as the recording spells it, or drop --set.`
+      });
+    }
+  } else {
+    warn(
+      opts,
+      `family "${opts.family}" was NOT checked against a recording \u2014 pass --set <recording-dir> to have the spelling verified, since a face cached under a name the mount does not match leaves scoring refusing for a family that still looks provided`
+    );
+  }
+  const result = addSystemFamily(opts.family, { cacheDir: opts.cacheDir, ...opts.weights !== void 0 ? { weights: opts.weights } : {} });
+  if (result.refusal !== void 0) {
+    fail(opts, ExitCode.InputValidation, {
+      error: `"${opts.family}" is a refusal-class family: ${result.refusal}`,
+      code: "font-family-refused",
+      remediation: `Pick a face the design system can actually license for rendering, or resolve a served family: ${tendrilCommand('fonts resolve "<Family>" --weights 400 500 600')}.`
+    });
+  }
+  if (result.added.length === 0) {
+    fail(opts, ExitCode.InputValidation, {
+      error: result.skipped.length > 0 ? `no cacheable face for "${opts.family}" \u2014 every match was skipped: ${result.skipped.map((s) => `${s.subfamily || "Regular"} (${s.reason})`).join("; ")}` : `no installed face matches "${opts.family}" \u2014 nothing in ${systemFontDirs().join(", ")} declares that family`,
+      code: "font-family-not-installed",
+      remediation: `See what IS installed: ${tendrilCommand(`fonts discover ${quoteArg(opts.family)}`)} (or all faces with ${tendrilCommand("fonts discover")}).`
+    });
+  }
+  for (const o of result.overwrote) {
+    warn(
+      opts,
+      `OVERWROTE ${o.family} ${o.weight}: the cache held a ${o.priorLicense} face from ${o.priorSource} (sha ${o.priorSha256.slice(0, 12)}\u2026) and it has been REPLACED by this machine's system bytes \u2014 the environment stamp changes, and any bundle emitted under the old face now fails checkFontLock against this cache. Restore the foundry face with ${tendrilCommand(`fonts resolve "${o.family}" --weights ${o.weight}`)} if that was not intended`
+    );
+  }
+  emitData(opts, result, () => {
+    for (const f of result.added) process.stdout.write(`added ${f.family} ${f.weight} \u2014 ${f.subfamily} \u2014 from ${f.source} (${f.sha256.slice(0, 12)}\u2026) \u2014 licence unknown: bundles DECLARE this face, its bytes never ship
+`);
+    for (const s of result.skipped) process.stdout.write(`skipped ${s.subfamily || "Regular"} ${s.weight}: ${s.reason}
+`);
+  });
+}
 var init_fonts = __esm({
   "packages/cli/src/commands/fonts.ts"() {
     "use strict";
@@ -10640,15 +11032,24 @@ __export(verify_exports, {
   resolveComposition: () => resolveComposition,
   runVerify: () => runVerify
 });
-import { existsSync as existsSync26, readFileSync as readFileSync22 } from "node:fs";
-import path33 from "node:path";
+import { existsSync as existsSync27, readFileSync as readFileSync23 } from "node:fs";
+import path34 from "node:path";
 function interactionCoverage(behaviors) {
-  const interaction = behaviors.filter((b) => !b.id.startsWith("prelude:"));
+  const parity = behaviors.filter((b) => b.id.startsWith("parity:"));
+  const interaction = behaviors.filter((b) => !b.id.startsWith("prelude:") && !b.id.startsWith("parity:"));
   return {
     interactionChecks: interaction.length,
     interactionPassed: interaction.filter((b) => b.pass).length,
-    preludeChecks: behaviors.length - interaction.length,
-    operability: interaction.length > 0 && interaction.every((b) => b.pass) ? "verified" : "unverified"
+    preludeChecks: behaviors.length - interaction.length - parity.length,
+    parityChecks: parity.length,
+    parityPassed: parity.filter((b) => b.pass).length,
+    // Asymmetric on purpose (review finding F3): a parity PASS never
+    // makes operability "verified" (parity is pixel-parity, not
+    // someone typing or clicking — the §0j miscount), but a parity
+    // FAIL still forbids it — "verified" printed beside a broken hover
+    // state is the one word doing too much lifting again, from the
+    // other direction.
+    operability: interaction.length > 0 && interaction.every((b) => b.pass) && parity.every((b) => b.pass) ? "verified" : "unverified"
   };
 }
 function operabilityReport(input) {
@@ -10681,6 +11082,16 @@ function operabilityReport(input) {
       unverified: `the interaction checks RAN and ${failed} of ${interactionChecks} failed (each named in the FAIL behavior rows) \u2014 this component WAS exercised and did not behave as the recording requires; unverified here means measured and wrong, not unmeasured.`
     };
   }
+  const { parityChecks, parityPassed } = interactionCoverage(input.behaviors);
+  if (parityPassed < parityChecks) {
+    const failed = parityChecks - parityPassed;
+    return {
+      checks: interactionChecks,
+      passed: interactionPassed,
+      short: `${failed} of ${parityChecks} state-parity check(s) failed`,
+      unverified: `the interaction checks passed but ${failed} of ${parityChecks} state-parity check(s) FAILED (the parity: rows) \u2014 a certified forced state is masking a broken real one, so operability cannot read as verified beside it.`
+    };
+  }
   return { checks: interactionChecks, passed: interactionPassed };
 }
 function operabilityLine(state) {
@@ -10773,7 +11184,7 @@ function compositionReport(input) {
 function eyeCheck(bundleDir) {
   return {
     command: tendrilCommand(`inspect "${bundleDir}"`),
-    sheetPath: path33.join(bundleDir, "verify-evidence", "inspect.html"),
+    sheetPath: path34.join(bundleDir, "verify-evidence", "inspect.html"),
     note: "magnified recorded-vs-rendered crops of every small node; scores cannot see shape. The command WRITES/refreshes the sheet at sheetPath \u2014 re-run it after every verify; an existing sheet may show stale crops."
   };
 }
@@ -10785,7 +11196,7 @@ function taskFromManifest(opts, manifest, setDir) {
   const adapterSlugs = Object.keys(manifest.propAdapter);
   const unmapped = recordedSlugs.filter((s) => !adapterSlugs.includes(s));
   const adapterOnly = adapterSlugs.filter((s) => !recordedSlugs.includes(s));
-  const registry = Object.values(TASKS).find((t) => path33.resolve(t.set) === path33.resolve(setDir));
+  const registry = Object.values(TASKS).find((t) => path34.resolve(t.set) === path34.resolve(setDir));
   const authored = (() => {
     if (registry !== void 0) return void 0;
     try {
@@ -10811,6 +11222,10 @@ function taskFromManifest(opts, manifest, setDir) {
     task,
     unmapped,
     adapterOnly,
+    // The parity AUTHORITY: CLI-owned configs for the same poses —
+    // recording-derived (authored) or registry-declared — never the
+    // adapter, which is the graded artifact framing itself (§0j).
+    authorityConfigs: behaviorSource.configs,
     // Registry sets carry hand-declared behaviors and no derivation
     // runs, so their evidence is UNKNOWN, not empty: an empty list is
     // spent downstream as "the recording holds no interactive pose".
@@ -10820,19 +11235,19 @@ function taskFromManifest(opts, manifest, setDir) {
 }
 async function runVerify(opts) {
   const callerCwd = process.env["INIT_CWD"] ?? process.cwd();
-  const setOverride = opts.set !== void 0 ? path33.resolve(callerCwd, opts.set) : void 0;
-  opts = { ...opts, bundleDir: path33.resolve(callerCwd, opts.bundleDir), ...setOverride !== void 0 ? { set: setOverride } : {} };
-  if (!existsSync26(opts.bundleDir)) {
+  const setOverride = opts.set !== void 0 ? path34.resolve(callerCwd, opts.set) : void 0;
+  opts = { ...opts, bundleDir: path34.resolve(callerCwd, opts.bundleDir), ...setOverride !== void 0 ? { set: setOverride } : {} };
+  if (!existsSync27(opts.bundleDir)) {
     fail(opts, ExitCode.InputValidation, {
       error: `bundle directory not found: ${opts.bundleDir}`,
       code: "bundle-missing",
       remediation: "Point at a generated bundle directory (containing component.json, the entry module, and styles.css)."
     });
   }
-  const manifestPath2 = path33.join(opts.bundleDir, "component.json");
+  const manifestPath2 = path34.join(opts.bundleDir, "component.json");
   let manifest;
-  if (existsSync26(manifestPath2)) {
-    const { manifest: parsed, issues } = readBundleManifest(readFileSync22(manifestPath2, "utf8"));
+  if (existsSync27(manifestPath2)) {
+    const { manifest: parsed, issues } = readBundleManifest(readFileSync23(manifestPath2, "utf8"));
     if (issues.length > 0) {
       fail(opts, ExitCode.InputValidation, {
         error: `bundle manifest rejected at ingest: ${issues.map((i) => i.message).join("; ")}`,
@@ -10846,6 +11261,7 @@ async function runVerify(opts) {
   let unmapped = [];
   let interactionEvidence;
   let unmappedInteractionEvidence = [];
+  let authorityConfigs;
   let availability = ROLES_NOT_RESOLVED;
   if (opts.task !== void 0) {
     const registry = TASKS[opts.task];
@@ -10859,21 +11275,21 @@ async function runVerify(opts) {
     task = registry;
   } else if (manifest !== void 0) {
     const resolveSetDir = (p) => {
-      if (path33.isAbsolute(p)) return p;
-      const fromRepo = path33.resolve(REPO_ROOT, p);
-      if (existsSync26(fromRepo)) return fromRepo;
-      return path33.resolve(callerCwd, p);
+      if (path34.isAbsolute(p)) return p;
+      const fromRepo = path34.resolve(REPO_ROOT, p);
+      if (existsSync27(fromRepo)) return fromRepo;
+      return path34.resolve(callerCwd, p);
     };
     const setDir = opts.set ?? resolveSetDir(manifest.provenance.recordingSet.path);
-    if (!existsSync26(path33.join(setDir, "recording-set.json")) && !Object.values(TASKS).some((t) => path33.resolve(t.set) === path33.resolve(setDir))) {
+    if (!existsSync27(path34.join(setDir, "recording-set.json")) && !Object.values(TASKS).some((t) => path34.resolve(t.set) === path34.resolve(setDir))) {
       fail(opts, ExitCode.RecordingIncomplete, {
         error: `recording set not found or unmanifested: ${setDir}`,
         code: "recording-set-missing",
         remediation: "Pass --set <dir> pointing at the recording set this bundle was generated from."
       });
     }
-    const registry = Object.values(TASKS).find((t) => path33.resolve(t.set) === path33.resolve(setDir));
-    if (registry !== void 0 && !existsSync26(path33.join(setDir, "recording-set.json"))) {
+    const registry = Object.values(TASKS).find((t) => path34.resolve(t.set) === path34.resolve(setDir));
+    if (registry !== void 0 && !existsSync27(path34.join(setDir, "recording-set.json"))) {
       const recordedSlugs = registry.configs.map((c) => c.rep);
       const adapterSlugs = Object.keys(manifest.propAdapter);
       unmapped = recordedSlugs.filter((s) => !adapterSlugs.includes(s));
@@ -10882,10 +11298,12 @@ async function runVerify(opts) {
         entry: manifest.entry,
         configs: adapterSlugs.filter((s) => recordedSlugs.includes(s)).map((rep) => ({ rep, component: manifest.propAdapter[rep].component, props: manifest.propAdapter[rep].props }))
       };
+      authorityConfigs = registry.configs;
     } else {
       const built = taskFromManifest(opts, manifest, setDir);
       task = built.task;
       unmapped = built.unmapped;
+      authorityConfigs = built.authorityConfigs;
       interactionEvidence = built.interactionEvidence;
       unmappedInteractionEvidence = built.unmappedInteractionEvidence;
       for (const s of built.adapterOnly) warn(opts, `prop adapter maps "${s}" which is not in the recording set \u2014 ignored`);
@@ -10897,9 +11315,9 @@ async function runVerify(opts) {
       warn(opts, `recording set content differs from the bundle's provenance stamp (${hash.slice(0, 12)}\u2026 vs ${manifest.provenance.recordingSet.hash.slice(0, 12)}\u2026) \u2014 scores apply to the CURRENT set`);
     }
     for (const name of [manifest.entry, "styles.css", "tokens.css"]) {
-      const p = path33.join(opts.bundleDir, name);
-      if (!existsSync26(p)) continue;
-      const issues = checkBundleSourceFile(name, new Uint8Array(readFileSync22(p)));
+      const p = path34.join(opts.bundleDir, name);
+      if (!existsSync27(p)) continue;
+      const issues = checkBundleSourceFile(name, new Uint8Array(readFileSync23(p)));
       if (issues.length > 0) {
         fail(opts, ExitCode.InputValidation, {
           error: `bundle source rejected at ingest: ${issues.map((i) => i.message).join("; ")}`,
@@ -10937,7 +11355,7 @@ async function runVerify(opts) {
     warn(opts, `font weights (advisory): the recording implies weights ${g.declared.join(", ")} for "${g.family}" \u2014 cache provides ${g.provided.join(", ")}; nearest-weight rendering may shift stroke density (certification stays family-gated; implied weights can leak across families)`);
   }
   const missing = task.configs.filter(
-    (c) => !existsSync26(path33.join(task.set, c.rep, "get_screenshot.json")) || !existsSync26(path33.join(task.set, c.rep, "get_metadata.json"))
+    (c) => !existsSync27(path34.join(task.set, c.rep, "get_screenshot.json")) || !existsSync27(path34.join(task.set, c.rep, "get_metadata.json"))
   );
   if (missing.length > 0) {
     fail(opts, ExitCode.RecordingIncomplete, {
@@ -10947,12 +11365,12 @@ async function runVerify(opts) {
     });
   }
   const bar = BARS2[opts.bar];
-  const evidenceDir = path33.join(opts.bundleDir, "verify-evidence");
+  const evidenceDir = path34.join(opts.bundleDir, "verify-evidence");
   const scores = await scoreBundleForTask(task, opts.bundleDir, bar, { evidenceDir, onProgress: emitProgress });
   const quality = await checkBundleQuality(opts.bundleDir, task.entry, { dir: task.set, reps: task.configs.map((c) => c.rep) });
-  const bundleCss = ["tokens.css", "styles.css"].map((f) => path33.join(opts.bundleDir, f)).filter((f) => existsSync26(f)).map((f) => readFileSync22(f, "utf8")).join("\n");
+  const bundleCss = ["tokens.css", "styles.css"].map((f) => path34.join(opts.bundleDir, f)).filter((f) => existsSync27(f)).map((f) => readFileSync23(f, "utf8")).join("\n");
   const occlusion = await checkSiblingOcclusion(task, opts.bundleDir, bundleCss);
-  const parity = await checkHoverParity(task, opts.bundleDir);
+  const parity = await checkHoverParity(task, opts.bundleDir, authorityConfigs ?? task.configs);
   const behaviors = [...await checkBehaviors(task, opts.bundleDir), ...parity];
   const structural = roles !== void 0 ? await checkStructuralComposition(task, opts.bundleDir, roles) : [];
   const regionsOut = roles !== void 0 ? interiorRegions(task.set, roles) : void 0;
@@ -11135,6 +11553,9 @@ ${certified}/${statuses.length} certified \xB7 ${report.coverage.pass}/${statuse
           `INCOMPLETE  ${cov.unrecordedConfigs} of ${cov.latticeConfigs} lattice poses were NEVER RECORDED \u2014 nothing verifies them; any implementation of those poses is inference, not verified truth. Re-plan the set (full matrix is the default) and record the missing poses.
 `
         );
+      } else if (typeof cov.latticeConfigs === "number") {
+        process.stdout.write(`LATTICE   all ${cov.latticeConfigs} poses of the component set's own lattice are recorded and scored \u2014 the denominator is the set's, not the recorded subset's
+`);
       } else if (cov.latticeConfigs === null) {
         process.stdout.write(`COVERAGE  denominator unknown (set predates lattice tracking) \u2014 scored configs are verified; completeness is not established
 `);
@@ -11142,7 +11563,7 @@ ${certified}/${statuses.length} certified \xB7 ${report.coverage.pass}/${statuse
     }
     process.stdout.write(`environment: chrome=${report.environment.chromeVersion ?? report.environment.chrome} fonts=${report.environment.fontsManifestSha256 ?? "UNRESOLVED"}
 `);
-    const shippedFonts = requiredFontsManifest(cssFontFamilies(["styles.css", "tokens.css"].map((f) => path33.join(opts.bundleDir, f)).filter((f) => existsSync26(f)).map((f) => readFileSync22(f, "utf8")).join("\n")));
+    const shippedFonts = requiredFontsManifest(cssFontFamilies(["styles.css", "tokens.css"].map((f) => path34.join(opts.bundleDir, f)).filter((f) => existsSync27(f)).map((f) => readFileSync23(f, "utf8")).join("\n")));
     if (shippedFonts.length > 0 && substitutedFamilies.length === 0) {
       process.stdout.write(`fonts: scored with Tendril-cache faces \u2014 a consuming app must provision the same families (the bundle ships fonts.css when faces are shippable; sha-pinned list in component.json requiredFonts)
 `);
@@ -11232,18 +11653,18 @@ __export(engine_exports, {
   runEngineBrief: () => runEngineBrief,
   runEngineScore: () => runEngineScore
 });
-import { appendFileSync, existsSync as existsSync27, mkdirSync as mkdirSync8, readFileSync as readFileSync23, writeFileSync as writeFileSync12 } from "node:fs";
-import path34 from "node:path";
+import { appendFileSync, existsSync as existsSync28, mkdirSync as mkdirSync8, readFileSync as readFileSync24, writeFileSync as writeFileSync12 } from "node:fs";
+import path35 from "node:path";
 function resolveEngineTask(opts, callerCwd) {
-  const asPath = path34.resolve(callerCwd, opts.taskOrSet);
-  const isSet = existsSync27(path34.join(asPath, "recording-set.json"));
+  const asPath = path35.resolve(callerCwd, opts.taskOrSet);
+  const isSet = existsSync28(path35.join(asPath, "recording-set.json"));
   const registry = TASKS[opts.taskOrSet];
   if (registry !== void 0 && !isSet) return { task: registry, name: opts.taskOrSet, ref: opts.taskOrSet, disclosures: [], interactionEvidence: void 0 };
   if (isSet) {
     try {
       const authored = authorTaskFromSet(asPath);
       for (const d of authored.disclosures) warn(opts, d);
-      return { task: authored.task, name: path34.basename(asPath), ref: asPath, disclosures: authored.disclosures, interactionEvidence: authored.api.interactionEvidence, apiPin: { props: authored.api.apiPin.props, forcedStates: authored.api.apiPin.forcedStates } };
+      return { task: authored.task, name: path35.basename(asPath), ref: asPath, disclosures: authored.disclosures, interactionEvidence: authored.api.interactionEvidence, apiPin: { props: authored.api.apiPin.props, forcedStates: authored.api.apiPin.forcedStates } };
     } catch (err) {
       fail(opts, ExitCode.InputValidation, {
         error: `cannot author a task from ${asPath}: ${err instanceof Error ? err.message.split("\n")[0] : String(err)}`,
@@ -11270,9 +11691,9 @@ ${disclosures.map((d) => `- ${d}`).join("\n")}` : "";
   const brief = buildBrief(task.systemApi, bar, { colorScheme: recordingIsDark(task) ? "dark" : "light" }) + disclosureBlock;
   const segments = buildSegments(task, "files");
   let notRecorded;
-  const manifestPath2 = path34.join(task.set, "recording-set.json");
-  if (existsSync27(manifestPath2)) {
-    notRecorded = JSON.parse(readFileSync23(manifestPath2, "utf8")).notRecorded;
+  const manifestPath2 = path35.join(task.set, "recording-set.json");
+  if (existsSync28(manifestPath2)) {
+    notRecorded = JSON.parse(readFileSync24(manifestPath2, "utf8")).notRecorded;
   }
   const unverified = notRecorded !== void 0 && notRecorded !== "" ? `
 
@@ -11280,7 +11701,7 @@ ${disclosures.map((d) => `- ${d}`).join("\n")}` : "";
 DO NOT INVENT PIXELS FOR THESE POSES. Implement them ONLY as the composition of recorded per-axis truth (the custom-property composition rule: one paint axis sets variables, the other consumes) and list every such pose in your report as UNRECORDED-COMPOSED. Recording them is the real fix: re-plan the set (full matrix is the default) and record the missing poses.
 ${notRecorded}` : "";
   let fontProvisioning;
-  if (existsSync27(manifestPath2)) {
+  if (existsSync28(manifestPath2)) {
     const missingFams = unprovisionedFamilies(task.set);
     const unprovided = unprovisionedFaces(task.set);
     const weightOnly = missingFams.length === 0;
@@ -11306,9 +11727,9 @@ ${notRecorded}` : "";
 
 === TASK PAYLOAD (recorded truth, verbatim) ===
 ${segments}`;
-  const payloadFile = path34.resolve(callerCwd, opts.out ?? `tendril-out/${name}-brief.md`);
-  const candidateDirSuggestion = path34.resolve(callerCwd, `tendril-out/${name}-candidate`);
-  mkdirSync8(path34.dirname(payloadFile), { recursive: true });
+  const payloadFile = path35.resolve(callerCwd, opts.out ?? `tendril-out/${name}-brief.md`);
+  const candidateDirSuggestion = path35.resolve(callerCwd, `tendril-out/${name}-candidate`);
+  mkdirSync8(path35.dirname(payloadFile), { recursive: true });
   writeFileSync12(payloadFile, payload);
   emitData(
     opts,
@@ -11359,15 +11780,18 @@ ${segments}`;
   );
 }
 function appendScoreHistory(candidateDir, entry) {
-  appendFileSync(path34.join(candidateDir, "score-history.jsonl"), `${JSON.stringify({ at: (/* @__PURE__ */ new Date()).toISOString(), ...entry })}
+  const file = path35.join(candidateDir, "score-history.jsonl");
+  const starts = existsSync28(file) ? readFileSync24(file, "utf8").split("\n").filter((l) => l.includes('"event":"round-start"')).length : 0;
+  const round = entry.event === "round-start" ? starts + 1 : Math.max(1, starts);
+  appendFileSync(file, `${JSON.stringify({ at: (/* @__PURE__ */ new Date()).toISOString(), round, ...entry })}
 `);
 }
 async function runEngineScore(opts) {
   requireEntitlement(opts);
   const callerCwd = process.env["INIT_CWD"] ?? process.cwd();
-  const candidateDir = path34.resolve(callerCwd, opts.candidateDir);
+  const candidateDir = path35.resolve(callerCwd, opts.candidateDir);
   const { task, name, apiPin, interactionEvidence } = resolveEngineTask(opts, callerCwd);
-  if (!existsSync27(candidateDir)) {
+  if (!existsSync28(candidateDir)) {
     fail(opts, ExitCode.InputValidation, {
       error: `candidate directory not found: ${candidateDir}`,
       code: "candidate-missing",
@@ -11392,10 +11816,10 @@ async function runEngineScore(opts) {
   for (const g of missingWeights(task.set)) {
     warn(opts, `font weights (advisory): the recording implies weights ${g.declared.join(", ")} for "${g.family}" \u2014 cache provides ${g.provided.join(", ")}; nearest-weight rendering may shift stroke density (certification stays family-gated; implied weights can leak across families)`);
   }
-  if (opts.rebind !== true && existsSync27(path34.join(candidateDir, "component.json"))) {
+  if (opts.rebind !== true && existsSync28(path35.join(candidateDir, "component.json"))) {
     const prior = (() => {
       try {
-        const read = readBundleManifest(readFileSync23(path34.join(candidateDir, "component.json"), "utf8"));
+        const read = readBundleManifest(readFileSync24(path35.join(candidateDir, "component.json"), "utf8"));
         return read.manifest === void 0 ? { unreadable: true } : { hash: read.manifest.provenance.recordingSet.hash, path: read.manifest.provenance.recordingSet.path };
       } catch {
         return { unreadable: true };
@@ -11417,9 +11841,9 @@ async function runEngineScore(opts) {
     }
   }
   const bar = BARS3[opts.bar];
-  const evidenceDir = path34.join(candidateDir, "verify-evidence");
+  const evidenceDir = path35.join(candidateDir, "verify-evidence");
   const scores = await scoreBundleForTask(task, candidateDir, bar, { evidenceDir, onProgress: emitProgress });
-  const parity = await checkHoverParity(task, candidateDir);
+  const parity = await checkHoverParity(task, candidateDir, task.configs);
   const behaviors = [...await checkBehaviors(task, candidateDir), ...parity];
   const parityCoverage = parity.length > 0 ? `${parity.filter((p) => p.pass).length}/${parity.length} hover-forced configs` : "not applicable (no hover-forced configs in this set)";
   const obj = objective(scores, behaviors);
@@ -11447,7 +11871,10 @@ ${absentFindings.join("\n")}` : "";
 
 CERTIFICATION: ${certifiedReps.length}/${scores.length} configs at the certification bar (sim \u2265${certBar.sim} AND ink \u2265${certBar.ink}, exact values, after parity demotion \u2014 composition checks at verify can demote further).${certifiedReps.length < scores.length ? ` Below cert: ${scores.filter((sc) => !certifiedSet.has(sc.rep)).map((sc) => sc.rep).join(", ")}.` : ""}
 METRIC DEADBAND (read before iterating on near-misses): the scored similarity/ink deliberately tolerate \xB11px edge shift and antialiased-edge differences \u2014 cross-rasterizer noise absorption. A change entirely inside that band moves these numbers by EXACTLY ZERO (working as designed, not a stuck scorer). The per-config \`exact\` fields in the JSON are tolerance-free and move first: compare exact across rounds to confirm a small fix landed, and stop iterating when only exact moves \u2014 the bar reads the tolerant numbers.`;
-  const feedback = buildFeedback(scores, behaviors, bar, "files") + certificationFeedback + qualityFeedback;
+  const stampNotice = `
+
+PROVENANCE STAMP: this scoring call itself (the Tendril CLI) just wrote/refreshed a comment on line 1 of styles.css carrying these scores, marked non-authoritative. If your editor or host reports styles.css was modified externally, that modification is this scorer \u2014 expected, not tampering. Keep the comment; it self-invalidates on any edit and \`tendril verify\` recomputes it.`;
+  const feedback = buildFeedback(scores, behaviors, bar, "files") + certificationFeedback + stampNotice + qualityFeedback;
   const emitted = emitBundleV1({
     bundleDir: candidateDir,
     task,
@@ -11460,7 +11887,17 @@ METRIC DEADBAND (read before iterating on near-misses): the scored similarity/in
     environment: environmentStamp(taskFontFamilies(task.set)),
     substitutedFamilies
   });
-  appendScoreHistory(candidateDir, { event: "round-scored", bar: opts.bar, pass: obj[0], total, certified: certifiedReps.length, floor: obj[1], mean: obj[2] });
+  appendScoreHistory(candidateDir, {
+    event: "round-scored",
+    bar: opts.bar,
+    pass: obj[0],
+    total,
+    pixelConfigsPassing: scores.filter((s) => s.pass).length,
+    pixelConfigs: scores.length,
+    certified: certifiedReps.length,
+    floor: obj[1],
+    mean: obj[2]
+  });
   const coverage = interactionCoverage(behaviors);
   const operability = operabilityReport({ behaviors, interactionEvidence });
   const evidenceUnverified = (interactionEvidence?.length ?? 0) > 0 && coverage.interactionChecks === 0;
@@ -11502,7 +11939,7 @@ METRIC DEADBAND (read before iterating on near-misses): the scored similarity/in
       parityCoverage,
       evidenceDir,
       bundleManifest: emitted.written[0],
-      note: "styles.css was stamped with the bundle provenance comment on line 1 \u2014 preserve it in any post-score edit",
+      note: "the Tendril CLI (this scoring call) wrote the bundle provenance comment onto styles.css line 1 \u2014 an EXPECTED external modification, not tampering; preserve it in any post-score edit (it self-invalidates on edit and verify recomputes it)",
       allPass,
       environment: { ...environmentStamp(taskFontFamilies(task.set)), ruler: cliVersion() },
       ...lcdTextEnabled() ? { environmentOverrides: ["enable-lcd-text"] } : {},
@@ -11575,11 +12012,11 @@ var codeconnect_exports = {};
 __export(codeconnect_exports, {
   runCodeConnect: () => runCodeConnect
 });
-import { existsSync as existsSync28, readFileSync as readFileSync24, writeFileSync as writeFileSync13 } from "node:fs";
-import path35 from "node:path";
+import { existsSync as existsSync29, readFileSync as readFileSync25, writeFileSync as writeFileSync13 } from "node:fs";
+import path36 from "node:path";
 function runCodeConnect(opts) {
   const callerCwd = process.env["INIT_CWD"] ?? process.cwd();
-  const bundleDir = path35.resolve(callerCwd, opts.bundleDir);
+  const bundleDir = path36.resolve(callerCwd, opts.bundleDir);
   let url;
   try {
     url = new URL(opts.figmaUrl);
@@ -11595,7 +12032,7 @@ function runCodeConnect(opts) {
   }
   let manifest;
   try {
-    const read = readBundleManifest(readFileSync24(path35.join(bundleDir, "component.json"), "utf8"));
+    const read = readBundleManifest(readFileSync25(path36.join(bundleDir, "component.json"), "utf8"));
     if (read.manifest === void 0) throw new Error(read.issues.map((i) => i.message).join("; ") || "no component.json");
     manifest = read.manifest;
   } catch (err) {
@@ -11605,8 +12042,8 @@ function runCodeConnect(opts) {
       remediation: "Point at a bundle produced by the Tendril pipeline (it carries component.json), and verify it first."
     });
   }
-  const setDir = path35.resolve(callerCwd, opts.set ?? manifest.provenance.recordingSet.path);
-  if (!existsSync28(path35.join(setDir, "recording-set.json"))) {
+  const setDir = path36.resolve(callerCwd, opts.set ?? manifest.provenance.recordingSet.path);
+  if (!existsSync29(path36.join(setDir, "recording-set.json"))) {
     fail(opts, ExitCode.InputValidation, {
       error: `recording set not found at ${setDir}`,
       code: "codeconnect-no-set",
@@ -11627,10 +12064,10 @@ function runCodeConnect(opts) {
   const component = api.component;
   const recManifest = loadManifest(setDir);
   const poseNames = recManifest.latticeNames ?? recManifest.reps.map((r) => {
-    const meta = path35.join(setDir, r.slug, "get_metadata.json");
-    if (!existsSync28(meta)) return void 0;
+    const meta = path36.join(setDir, r.slug, "get_metadata.json");
+    if (!existsSync29(meta)) return void 0;
     try {
-      return /name="([^"]*)"/.exec(envelopeFirstTextPart(JSON.parse(readFileSync24(meta, "utf8"))))?.[1];
+      return /name="([^"]*)"/.exec(envelopeTextContent(JSON.parse(readFileSync25(meta, "utf8"))))?.[1];
     } catch {
       return void 0;
     }
@@ -11688,7 +12125,7 @@ function runCodeConnect(opts) {
     axisLines.push(`const ${varName} = instance.getEnum(${q(axis)}, { ${entries.join(", ")} })`);
     fragmentVars.push(varName);
   }
-  const entryRel = path35.relative(callerCwd, path35.join(bundleDir, manifest.entry));
+  const entryRel = path36.relative(callerCwd, path36.join(bundleDir, manifest.entry));
   const trust = manifest.trustStatement.split("\n")[0] ?? "";
   const lines = [
     `// url=${opts.figmaUrl}`,
@@ -11709,7 +12146,7 @@ function runCodeConnect(opts) {
     `}`,
     ``
   ].join("\n");
-  const outFile = path35.resolve(callerCwd, opts.out ?? path35.join(bundleDir, `${component}.figma.ts`));
+  const outFile = path36.resolve(callerCwd, opts.out ?? path36.join(bundleDir, `${component}.figma.ts`));
   writeFileSync13(outFile, lines);
   emitData(
     opts,
@@ -11749,17 +12186,17 @@ var init_codeconnect = __esm({
 
 // packages/mcp/src/server.ts
 import { createHash as createHash5 } from "node:crypto";
-import { existsSync as existsSync29, mkdtempSync as mkdtempSync3, readFileSync as readFileSync25, readdirSync as readdirSync8, writeFileSync as writeFileSync14 } from "node:fs";
-import os6 from "node:os";
-import path36 from "node:path";
+import { existsSync as existsSync30, mkdtempSync as mkdtempSync3, readFileSync as readFileSync26, readdirSync as readdirSync9, writeFileSync as writeFileSync14 } from "node:fs";
+import os7 from "node:os";
+import path37 from "node:path";
 import { fileURLToPath as fileURLToPath6 } from "node:url";
 import { z as z12 } from "zod";
 function sourceHash() {
-  const dir = path36.dirname(fileURLToPath6(import.meta.url));
+  const dir = path37.dirname(fileURLToPath6(import.meta.url));
   const h = createHash5("sha256");
-  for (const f of readdirSync8(dir).filter((n) => n.endsWith(".ts")).sort()) {
+  for (const f of readdirSync9(dir).filter((n) => n.endsWith(".ts")).sort()) {
     h.update(f);
-    h.update(readFileSync25(path36.join(dir, f)));
+    h.update(readFileSync26(path37.join(dir, f)));
   }
   return h.digest("hex").slice(0, 16);
 }
@@ -11767,10 +12204,10 @@ var REPO_ROOT3, CLI_BIN, BUNDLED_CLI, CLI_SPAWN, str, optStr, TOOLS, BOOT_HASH;
 var init_server = __esm({
   "packages/mcp/src/server.ts"() {
     "use strict";
-    REPO_ROOT3 = path36.resolve(path36.dirname(fileURLToPath6(import.meta.url)), "..", "..", "..");
-    CLI_BIN = path36.join(REPO_ROOT3, "packages", "cli", "src", "bin.ts");
-    BUNDLED_CLI = path36.join(path36.dirname(fileURLToPath6(import.meta.url)), "tendril.js");
-    CLI_SPAWN = existsSync29(BUNDLED_CLI) ? { cmd: process.execPath, prefix: [BUNDLED_CLI] } : { cmd: "npx", prefix: ["tsx", CLI_BIN] };
+    REPO_ROOT3 = path37.resolve(path37.dirname(fileURLToPath6(import.meta.url)), "..", "..", "..");
+    CLI_BIN = path37.join(REPO_ROOT3, "packages", "cli", "src", "bin.ts");
+    BUNDLED_CLI = path37.join(path37.dirname(fileURLToPath6(import.meta.url)), "tendril.js");
+    CLI_SPAWN = existsSync30(BUNDLED_CLI) ? { cmd: process.execPath, prefix: [BUNDLED_CLI] } : { cmd: "npx", prefix: ["tsx", CLI_BIN] };
     str = (d) => z12.string().describe(d);
     optStr = (d) => z12.string().optional().describe(d);
     TOOLS = [
@@ -11800,7 +12237,7 @@ var init_server = __esm({
           const single = i["metadata"];
           const parts = i["metadataParts"];
           if (single !== void 0 || parts !== void 0) {
-            const tmp = path36.join(mkdtempSync3(path36.join(os6.tmpdir(), "tendril-envelope-")), "response.txt");
+            const tmp = path37.join(mkdtempSync3(path37.join(os7.tmpdir(), "tendril-envelope-")), "response.txt");
             if (single !== void 0) {
               writeFileSync14(tmp, single);
               argvOut.push("--metadata-raw-file", tmp);
@@ -11817,11 +12254,19 @@ var init_server = __esm({
       },
       {
         name: "tendril_permissions",
-        description: "Install the Claude Code permission allowlist for the Tendril pipeline (write: true \u2014 merges per-tool entries into the project's .claude/settings.local.json, idempotent, never touches other settings), or list the entries without writing. OFFER THIS AT PIPELINE START whenever NO merged Claude settings file (project .claude/settings.local.json or .claude/settings.json, or user ~/.claude/settings.json) contains tendril MCP entries \u2014 plugin installs use mcp__plugin_tendril_tendril__*, direct claude-mcp-add installs use mcp__<server>__* (for those, write:true installs PLUGIN-prefixed names that will not match: list without writing and adapt the prefix instead). A FILE check, never prompt-watching \u2014 agents cannot observe permission prompts. ONE approval here replaces a prompt per pipeline call. Never run it unoffered; the user must reload the session for new settings to apply \u2014 say so.",
+        description: "Install the Claude Code permission allowlist for the Tendril pipeline (write: true \u2014 merges the MCP per-tool entries, the run's shell surface, and project-scoped Write/Edit with deny guards for ./.claude and ./.git into the project's .claude/settings.local.json, idempotent, never touches other keys), or list the entries without writing. The shell/Write grants are CONVENIENCE, not a security boundary \u2014 the output's note names exactly what they trade; RELAY it with the offer. OFFER THIS AT PIPELINE START whenever NO merged Claude settings file (project .claude/settings.local.json or .claude/settings.json, or user ~/.claude/settings.json) contains tendril MCP entries \u2014 plugin installs use mcp__plugin_tendril_tendril__*, direct claude-mcp-add installs use mcp__<server>__* \u2014 when this session's tool names differ from the plugin defaults, pass figmaPrefix/tendrilPrefix with the prefixes you actually see, or the written entries never match. A FILE check, never prompt-watching \u2014 agents cannot observe permission prompts. ONE approval here replaces a prompt per pipeline call. Never run it unoffered; the user must reload the session for new settings to apply \u2014 say so.",
         schema: z12.object({
-          write: z12.boolean().optional().describe("true = install into .claude/settings.local.json (the point of this tool); false/absent = just return the entries")
+          write: z12.boolean().optional().describe("true = install into .claude/settings.local.json (the point of this tool); false/absent = just return the entries"),
+          figmaPrefix: z12.string().optional().describe("The Figma server's entry prefix AS THIS SESSION NAMES ITS TOOLS \u2014 the part before __get_metadata (e.g. mcp__figma-remote, mcp__plugin_figma_figma). Pass it whenever the session's Figma tools are not mcp__plugin_figma_figma__* \u2014 entries written under the wrong prefix never match anything (measured: six dead entries in a figma-remote session)."),
+          tendrilPrefix: z12.string().optional().describe("Same for the tendril server when this session's tendril tools are not mcp__plugin_tendril_tendril__* (e.g. mcp__tendril for claude mcp add installs).")
         }),
-        argv: (i) => ["permissions", "--claude", ...i["write"] === true ? ["--write"] : []]
+        argv: (i) => [
+          "permissions",
+          "--claude",
+          ...i["write"] === true ? ["--write"] : [],
+          ...typeof i["figmaPrefix"] === "string" ? ["--figma-prefix", i["figmaPrefix"]] : [],
+          ...typeof i["tendrilPrefix"] === "string" ? ["--tendril-prefix", i["tendrilPrefix"]] : []
+        ]
       },
       {
         name: "tendril_doctor",
@@ -11871,7 +12316,7 @@ var init_server = __esm({
           const bridge = (label, single, parts) => {
             if (single !== void 0 && parts !== void 0) throw new Error(`pass at most one of \`${label}\` and \`${label}Parts\``);
             if (single === void 0 && parts === void 0) return;
-            const tmp = path36.join(mkdtempSync3(path36.join(os6.tmpdir(), "tendril-envelope-")), "response.txt");
+            const tmp = path37.join(mkdtempSync3(path37.join(os7.tmpdir(), "tendril-envelope-")), "response.txt");
             if (single !== void 0) {
               writeFileSync14(tmp, single);
               argvOut.push(`--${label}-file`, tmp);
@@ -11914,7 +12359,7 @@ var init_server = __esm({
           const file = i["file"];
           if ([text, texts, file].filter((x) => x !== void 0).length !== 1) throw new Error("pass exactly one of `text` (single-block response), `texts` (multi-block response), or `file` (a saved envelope)");
           if (file !== void 0) return [...base, "--file", file];
-          const tmp = path36.join(mkdtempSync3(path36.join(os6.tmpdir(), "tendril-envelope-")), "response.txt");
+          const tmp = path37.join(mkdtempSync3(path37.join(os7.tmpdir(), "tendril-envelope-")), "response.txt");
           if (text !== void 0) {
             writeFileSync14(tmp, text);
             return [...base, "--file", tmp, "--raw"];
@@ -11946,7 +12391,7 @@ var init_server = __esm({
       {
         name: "tendril_record_status",
         annotations: { readOnlyHint: true },
-        description: "Recording-set completeness: per-rep recorded/missing tools.",
+        description: "Recording-set completeness: per-rep recorded/missing tools, files that exist but are unusable (invalid \u2014 re-record those), and whether the set-level token map is recorded. `complete` means USABLE by the next pipeline step, including the set-level get_variable_defs.",
         schema: z12.object({ setDir: str("recording set directory") }),
         argv: (i) => ["record", "status", "--set", i["setDir"]]
       },
@@ -11977,7 +12422,7 @@ var init_server = __esm({
       },
       {
         name: "tendril_engine_score",
-        description: "AGENT-HARNESS engine, step 2 (the oracle): scores a candidate bundle directory against recorded truth \u2014 per-config pixels, behaviors, hover parity \u2014 and returns feedback plus evidence artifacts. Iterate until allPass or two non-improving rounds. Only THIS tool's output counts as a score; never claim numbers yourself.",
+        description: "AGENT-HARNESS engine, step 2 (the oracle): scores a candidate bundle directory against recorded truth \u2014 per-config pixels, behaviors, state parity (recording-selected \u2014 a bundle cannot unschedule it) \u2014 and returns feedback plus evidence artifacts. Iterate until allPass or two non-improving rounds. Only THIS tool's output counts as a score; never claim numbers yourself.",
         schema: z12.object({
           taskOrSet: str("reference task name or recording-set directory"),
           candidateDir: str("directory containing the proposed bundle files"),
@@ -12067,15 +12512,16 @@ __export(permissions_exports, {
   PERMISSIONS_DESCRIPTION: () => PERMISSIONS_DESCRIPTION,
   buildPermissions: () => buildPermissions,
   mergeAllowlist: () => mergeAllowlist,
-  runPermissions: () => runPermissions
+  runPermissions: () => runPermissions,
+  writeSelection: () => writeSelection
 });
-import { existsSync as existsSync30, mkdirSync as mkdirSync9, readFileSync as readFileSync26, writeFileSync as writeFileSync15 } from "node:fs";
-import os7 from "node:os";
-import path37 from "node:path";
-function mergeAllowlist(file, entries) {
+import { existsSync as existsSync31, mkdirSync as mkdirSync9, readFileSync as readFileSync27, writeFileSync as writeFileSync15 } from "node:fs";
+import os8 from "node:os";
+import path38 from "node:path";
+function mergeAllowlist(file, entries, denyEntries = []) {
   let settings = {};
-  if (existsSync30(file) && readFileSync26(file, "utf8").trim() !== "") {
-    settings = JSON.parse(readFileSync26(file, "utf8"));
+  if (existsSync31(file) && readFileSync27(file, "utf8").trim() !== "") {
+    settings = JSON.parse(readFileSync27(file, "utf8"));
     if (settings === null || typeof settings !== "object" || Array.isArray(settings)) throw new Error("settings root is not an object");
   }
   const permissions = settings["permissions"] ??= {};
@@ -12085,16 +12531,31 @@ function mergeAllowlist(file, entries) {
   const present = new Set(allow.filter((x) => typeof x === "string"));
   const added = entries.filter((e) => !present.has(e));
   const alreadyPresent = entries.filter((e) => present.has(e));
-  if (added.length > 0) {
+  let denyAdded = [];
+  if (denyEntries.length > 0) {
+    const deny = permissions["deny"] ??= [];
+    if (!Array.isArray(deny)) throw new Error("permissions.deny is not an array");
+    const denyPresent = new Set(deny.filter((x) => typeof x === "string"));
+    denyAdded = denyEntries.filter((e) => !denyPresent.has(e));
+    deny.push(...denyAdded);
+  }
+  if (added.length > 0 || denyAdded.length > 0) {
     allow.push(...added);
-    mkdirSync9(path37.dirname(file), { recursive: true });
+    mkdirSync9(path38.dirname(file), { recursive: true });
     writeFileSync15(file, `${JSON.stringify(settings, null, 2)}
 `);
   }
-  return { added, alreadyPresent };
+  return { added, alreadyPresent, denyAdded };
 }
 async function buildPermissions(options) {
   const LEGAL_TOOL_NAME = /^[A-Za-z0-9_-]+$/;
+  for (const [flag, value] of [["--figma-prefix", options.figmaPrefix], ["--tendril-prefix", options.tendrilPrefix]]) {
+    if (value !== void 0 && !LEGAL_MCP_PREFIX.test(value)) {
+      throw new Error(`${flag} must look like mcp__<server-name> (letters, digits, _ and - only) \u2014 got ${JSON.stringify(value)}`);
+    }
+  }
+  const figmaPrefix = options.figmaPrefix ?? FIGMA_PLUGIN_PREFIX;
+  const tendrilPrefix = options.tendrilPrefix ?? TENDRIL_PLUGIN_PREFIX;
   const pipeline = new Set(FIGMA_TOOL_FALLBACK);
   let figmaTools = FIGMA_TOOL_FALLBACK;
   try {
@@ -12106,38 +12567,64 @@ async function buildPermissions(options) {
   }
   return {
     host: "claude",
-    serverEntries: [TENDRIL_PLUGIN_PREFIX, FIGMA_PLUGIN_PREFIX],
+    serverEntries: [tendrilPrefix, figmaPrefix],
     toolEntries: [
-      ...TOOLS.map((t) => t.name).filter((n) => LEGAL_TOOL_NAME.test(n)).map((n) => `${TENDRIL_PLUGIN_PREFIX}__${n}`),
-      ...figmaTools.map((name) => `${FIGMA_PLUGIN_PREFIX}__${name}`)
+      ...TOOLS.map((t) => t.name).filter((n) => LEGAL_TOOL_NAME.test(n)).map((n) => `${tendrilPrefix}__${n}`),
+      ...figmaTools.map((name) => `${figmaPrefix}__${name}`)
     ],
+    shellEntries: [...SHELL_READONLY_ENTRIES, ...SHELL_PIPELINE_ENTRIES],
+    projectFileEntries: PROJECT_FILE_ENTRIES,
+    projectDenyEntries: PROJECT_DENY_ENTRIES,
+    manualCautionEntries: MANUAL_CAUTION_ENTRIES,
+    shellEntriesNote: "These are CONVENIENCE grants replacing the ~300 prompts a measured run costs \u2014 not a security boundary. What they trade, named: (1) the read verbs (cat/grep/head/\u2026) let the agent read ANY file without a prompt, secrets included \u2014 remove those entries if that is unacceptable; (2) Claude Code Bash patterns are prefix matches and redirection is not a command separator (`cat x > file` rides `Bash(cat:*)`) \u2014 the host's docs call argument patterns best-effort, not an enforcement boundary (pipes and `&&`/`;` chains do decompose, each piece prompting on its own); (3) the per-subcommand CLI grants carry those subcommands' own write surface (recordings, bundles, score history, --out paths) and the npx form trusts future @latest publishes. Never auto-written: a blanket `tendril` grant (an agent could silently widen this very allowlist via `tendril permissions --write`), `find` (arbitrary delete/exec via -delete/-exec), clobber verbs \u2014 those stay a manual, deliberate addition. Write/Edit are project-scoped, written only to the project-local file, with deny entries for ./.claude/** and ./.git/** so the grant can never rewrite this settings file or plant git hooks. Every entry is removable any time.",
     serverEntriesCaution: "The server-wide entries allow EVERY tool those servers serve \u2014 for tendril that includes tendril_generate_curated (spends your OpenRouter budget when configured), and for Figma every tool the desktop server exposes, beyond the read tools this pipeline uses. The per-tool list is the recommended default.",
-    directConfigNote: `Installed via claude mcp add instead of the plugin? Replace the prefixes: ${TENDRIL_PLUGIN_PREFIX}__<tool> becomes mcp__<your-server-name>__<tool> (same for Figma).`
+    directConfigNote: `Prefixes default to the plugin install shape. A different install (claude mcp add, the remote Figma server, \u2026) names its tools mcp__<server-name>__<tool> \u2014 pass the real prefixes with --figma-prefix / --tendril-prefix (MCP: figmaPrefix / tendrilPrefix) so the written entries actually match; run 20 measured six Figma entries that could never fire because the session's server was figma-remote.`
   };
 }
+function writeSelection(result, user) {
+  return user ? { entries: [...result.toolEntries], denyEntries: [] } : { entries: [...result.toolEntries, ...result.shellEntries, ...result.projectFileEntries], denyEntries: [...result.projectDenyEntries] };
+}
 async function runPermissions(flags) {
   if (flags.describe) {
     printDescription(PERMISSIONS_DESCRIPTION);
     return;
   }
-  const result = await buildPermissions({ ...flags.mcpUrl ? { mcpUrl: flags.mcpUrl } : {} });
+  let result;
+  try {
+    result = await buildPermissions({
+      ...flags.mcpUrl ? { mcpUrl: flags.mcpUrl } : {},
+      ...flags.figmaPrefix !== void 0 ? { figmaPrefix: flags.figmaPrefix } : {},
+      ...flags.tendrilPrefix !== void 0 ? { tendrilPrefix: flags.tendrilPrefix } : {}
+    });
+  } catch (err) {
+    fail(flags, ExitCode.InputValidation, {
+      error: err instanceof Error ? err.message : String(err),
+      code: "bad-prefix",
+      remediation: "Pass the prefix exactly as the session names its MCP tools: the part before the final __<tool> (e.g. mcp__figma-remote, mcp__plugin_figma_figma)."
+    });
+    return;
+  }
   if (flags.write) {
     const base = process.env["INIT_CWD"] ?? process.cwd();
-    const file = flags.user ? path37.join(os7.homedir(), ".claude", "settings.json") : path37.join(base, ".claude", "settings.local.json");
+    const file = flags.user ? path38.join(os8.homedir(), ".claude", "settings.json") : path38.join(base, ".claude", "settings.local.json");
+    const { entries, denyEntries } = writeSelection(result, flags.user === true);
     if (flags.dryRun) {
-      emitData(flags, { file, wouldAdd: result.toolEntries }, () => {
-        process.stdout.write(`dry-run: would merge ${result.toolEntries.length} per-tool entries into ${file}
-`);
+      emitData(flags, { file, wouldAdd: entries, wouldDeny: denyEntries }, () => {
+        process.stdout.write(
+          `dry-run: would merge ${entries.length} allow entries (${flags.user ? "MCP tools only \u2014 shell and Write/Edit grants stay project-local" : "MCP tools + shell surface + project Write/Edit"})${denyEntries.length > 0 ? ` and ${denyEntries.length} deny guards (./.claude/**, ./.git/**)` : ""} into ${file}
+`
+        );
       });
       return;
     }
     try {
-      const { added, alreadyPresent } = mergeAllowlist(file, result.toolEntries);
-      emitData(flags, { ...result, written: { file, added, alreadyPresent } }, () => {
+      const { added, alreadyPresent, denyAdded } = mergeAllowlist(file, entries, denyEntries);
+      emitData(flags, { ...result, written: { file, added, alreadyPresent, denyAdded } }, () => {
         process.stdout.write(
-          added.length === 0 ? `already installed: all ${alreadyPresent.length} Tendril pipeline entries present in ${file}
-` : `installed: ${added.length} allowlist entr${added.length === 1 ? "y" : "ies"} added to ${file}${alreadyPresent.length > 0 ? ` (${alreadyPresent.length} already present)` : ""}
-  restart or reopen the Claude Code session to pick up settings changes
+          added.length === 0 && denyAdded.length === 0 ? `already installed: all ${alreadyPresent.length} Tendril pipeline entries present in ${file}
+` : `installed: ${added.length} allowlist entr${added.length === 1 ? "y" : "ies"}${denyAdded.length > 0 ? ` and ${denyAdded.length} deny guard${denyAdded.length === 1 ? "" : "s"} (Write/Edit cannot touch ./.claude/** or ./.git/**)` : ""} added to ${file}${alreadyPresent.length > 0 ? ` (${alreadyPresent.length} already present)` : ""}
+${flags.user ? "" : `  \u26A0 ${result.shellEntriesNote}
+`}  restart or reopen the Claude Code session to pick up settings changes
 `
         );
       });
@@ -12162,6 +12649,24 @@ Or paste into .claude/settings.json under permissions.allow:
 
 ${quoted(result.toolEntries)}
 
+The SHELL surface a run actually uses:
+
+${quoted(result.shellEntries)}
+
+\u26A0 ${result.shellEntriesNote}
+
+Project-scoped file access (written only to the project-local file):
+
+${quoted(result.projectFileEntries)}
+
+\u2026with these under permissions.deny (so the grant above can never rewrite the settings file or .git):
+
+${quoted(result.projectDenyEntries)}
+
+Deliberate manual additions \u2014 clobber- or exec-capable, never auto-written:
+
+${quoted(result.manualCautionEntries)}
+
 Shorter but broader \u2014 one entry per server:
 
 ${quoted(result.serverEntries)}
@@ -12173,7 +12678,7 @@ ${result.directConfigNote}
     );
   });
 }
-var FIGMA_TOOL_FALLBACK, PERMISSIONS_DESCRIPTION, TENDRIL_PLUGIN_PREFIX, FIGMA_PLUGIN_PREFIX;
+var FIGMA_TOOL_FALLBACK, SHELL_READONLY_ENTRIES, SHELL_PIPELINE_ENTRIES, PROJECT_FILE_ENTRIES, PROJECT_DENY_ENTRIES, MANUAL_CAUTION_ENTRIES, PERMISSIONS_DESCRIPTION, TENDRIL_PLUGIN_PREFIX, FIGMA_PLUGIN_PREFIX, LEGAL_MCP_PREFIX;
 var init_permissions = __esm({
   "packages/cli/src/commands/permissions.ts"() {
     "use strict";
@@ -12185,15 +12690,47 @@ var init_permissions = __esm({
     init_output();
     init_doctor();
     FIGMA_TOOL_FALLBACK = ["get_metadata", "get_design_context", "get_screenshot", "get_variable_defs", "get_motion_context", "get_figjam"];
+    SHELL_READONLY_ENTRIES = [
+      "Bash(date:*)",
+      "Bash(ls:*)",
+      "Bash(stat:*)",
+      "Bash(wc:*)",
+      "Bash(head:*)",
+      "Bash(tail:*)",
+      "Bash(cat:*)",
+      "Bash(shasum:*)",
+      "Bash(grep:*)"
+    ];
+    SHELL_PIPELINE_ENTRIES = [
+      // The skill's own rule: candidate dirs are created with a bare
+      // `mkdir -p`, no compounds — one grant covers the whole batch.
+      "Bash(mkdir -p:*)",
+      // The published CLI, PER SUBCOMMAND — never `tendril *`. The CLI
+      // writes the settings file through Node fs, not the host's Write
+      // tool, so the protected-path guard that stops `Write(./**)` from
+      // touching .claude/ does NOT stop `tendril permissions --write`: a
+      // blanket grant would let an allowlisted agent silently widen its own
+      // allowlist (review finding, confirmed from the host's docs).
+      // `permissions`, `activate` and `init` are deliberately absent.
+      ...["verify", "inspect", "doctor", "record", "engine", "fonts", "generate"].flatMap((sub) => [
+        `Bash(tendril ${sub}:*)`,
+        `Bash(npx -y -p @tendrilapp/cli@latest tendril ${sub}:*)`
+      ])
+    ];
+    PROJECT_FILE_ENTRIES = ["Write(./**)", "Edit(./**)"];
+    PROJECT_DENY_ENTRIES = ["Write(./.claude/**)", "Edit(./.claude/**)", "Write(./.git/**)", "Edit(./.git/**)"];
+    MANUAL_CAUTION_ENTRIES = ["Bash(cp -R:*)", "Bash(find:*)"];
     PERMISSIONS_DESCRIPTION = {
       name: "permissions",
       summary: "Install (or print) the Claude Code permission allowlist for the Tendril pipeline (tendril + Figma MCP tools).",
       args: [],
       flags: [
         { flag: "--claude", description: "Claude Code settings format (the default and currently only format)" },
-        { flag: "--write", description: "Merge the per-tool entries into .claude/settings.local.json in the current project (idempotent; creates the file; never touches other keys)" },
-        { flag: "--user", description: "With --write: target ~/.claude/settings.json (every project) instead of the project-local file" },
+        { flag: "--write", description: "Merge the pipeline allowlist (MCP tools + shell surface + project Write/Edit, with deny guards for ./.claude and ./.git) into .claude/settings.local.json in the current project (idempotent; creates the file; never touches other keys)" },
+        { flag: "--user", description: "With --write: target ~/.claude/settings.json instead \u2014 MCP tool entries ONLY; shell and Write/Edit grants stay project-local, never every-project" },
         { flag: "--mcp-url <url>", description: "Figma MCP endpoint to list live tool names from", default: DEFAULT_MCP_URL },
+        { flag: "--figma-prefix <prefix>", description: "The session's real Figma MCP entry prefix (e.g. mcp__figma-remote) \u2014 the plugin-install default cannot match other install shapes" },
+        { flag: "--tendril-prefix <prefix>", description: "The session's real tendril MCP entry prefix (e.g. mcp__tendril for claude mcp add installs)" },
         { flag: "--json", description: "Machine-readable output" }
       ],
       output: {
@@ -12201,13 +12738,14 @@ var init_permissions = __esm({
         serverEntries: "string[] \u2014 one entry per MCP server (allows every tool it serves)",
         toolEntries: "string[] \u2014 per-tool entries for selective allowlists",
         directConfigNote: "string \u2014 prefix rewrite for non-plugin (claude mcp add) installs",
-        written: "with --write: { file, added, alreadyPresent }"
+        written: "with --write: { file, added, alreadyPresent, denyAdded }"
       },
       exitCodes: { 0: "printed or written", 3: "with --write: the target file exists but is not JSON this command can safely rewrite" },
       examples: ["tendril permissions --claude --write", "tendril permissions --claude", "tendril permissions --claude --json"]
     };
     TENDRIL_PLUGIN_PREFIX = "mcp__plugin_tendril_tendril";
     FIGMA_PLUGIN_PREFIX = "mcp__plugin_figma_figma";
+    LEGAL_MCP_PREFIX = /^mcp__[A-Za-z0-9_-]+$/;
   }
 });
 
@@ -12217,24 +12755,24 @@ __export(inspect_exports, {
   INSPECT_DESCRIPTION: () => INSPECT_DESCRIPTION,
   runInspect: () => runInspect
 });
-import { existsSync as existsSync31, readFileSync as readFileSync27, writeFileSync as writeFileSync16 } from "node:fs";
-import path38 from "node:path";
+import { existsSync as existsSync32, readFileSync as readFileSync28, writeFileSync as writeFileSync16 } from "node:fs";
+import path39 from "node:path";
 async function runInspect(opts) {
   if (opts.describe) {
     printDescription(INSPECT_DESCRIPTION);
     return;
   }
-  const bundleDir = path38.resolve(opts.bundleDir);
-  const evidenceDir = path38.join(bundleDir, "verify-evidence");
-  const manifestPath2 = path38.join(bundleDir, "component.json");
-  if (!existsSync31(evidenceDir) || !existsSync31(manifestPath2)) {
+  const bundleDir = path39.resolve(opts.bundleDir);
+  const evidenceDir = path39.join(bundleDir, "verify-evidence");
+  const manifestPath2 = path39.join(bundleDir, "component.json");
+  if (!existsSync32(evidenceDir) || !existsSync32(manifestPath2)) {
     fail(opts, ExitCode.InputValidation, {
-      error: `nothing to inspect in ${bundleDir} \u2014 ${existsSync31(manifestPath2) ? "no verify-evidence directory" : "no component.json"}`,
+      error: `nothing to inspect in ${bundleDir} \u2014 ${existsSync32(manifestPath2) ? "no verify-evidence directory" : "no component.json"}`,
       code: "no-evidence",
       remediation: `Run \`${tendrilCommand(`verify ${bundleDir}`)}\` first \u2014 inspect reads the ref/render evidence that run writes.`
     });
   }
-  const { manifest } = readBundleManifest(readFileSync27(manifestPath2, "utf8"));
+  const { manifest } = readBundleManifest(readFileSync28(manifestPath2, "utf8"));
   if (manifest === void 0) {
     fail(opts, ExitCode.InputValidation, {
       error: "component.json did not parse as a bundle manifest",
@@ -12242,8 +12780,8 @@ async function runInspect(opts) {
       remediation: "Re-emit the bundle (score/verify rewrite component.json), then re-run inspect."
     });
   }
-  const setDir = path38.resolve(opts.set ?? manifest.provenance.recordingSet.path);
-  const reps = Object.keys(manifest.propAdapter).filter((rep) => existsSync31(path38.join(evidenceDir, `${rep}-ref.png`)) && existsSync31(path38.join(evidenceDir, `${rep}-render.png`)));
+  const setDir = path39.resolve(opts.set ?? manifest.provenance.recordingSet.path);
+  const reps = Object.keys(manifest.propAdapter).filter((rep) => existsSync32(path39.join(evidenceDir, `${rep}-ref.png`)) && existsSync32(path39.join(evidenceDir, `${rep}-render.png`)));
   if (reps.length === 0) {
     fail(opts, ExitCode.InputValidation, {
       error: "verify-evidence holds no ref/render pairs for this bundle's configs",
@@ -12254,15 +12792,15 @@ async function runInspect(opts) {
   let crops = 0;
   const sections = [];
   for (const rep of reps) {
-    const ref = new Uint8Array(readFileSync27(path38.join(evidenceDir, `${rep}-ref.png`)));
-    const render = new Uint8Array(readFileSync27(path38.join(evidenceDir, `${rep}-render.png`)));
+    const ref = new Uint8Array(readFileSync28(path39.join(evidenceDir, `${rep}-ref.png`)));
+    const render = new Uint8Array(readFileSync28(path39.join(evidenceDir, `${rep}-render.png`)));
     const nodes = smallSemanticNodes(setDir, rep, opts.maxArea ?? 1024).slice(0, 12);
     const cells = [];
     for (const [i, n] of nodes.entries()) {
       const rect = { x: n.x, y: n.y, w: n.w, h: n.h };
       try {
-        writeFileSync16(path38.join(evidenceDir, `${rep}-inspect-${i}-ref.png`), zoomCrop(ref, rect));
-        writeFileSync16(path38.join(evidenceDir, `${rep}-inspect-${i}-render.png`), zoomCrop(render, rect));
+        writeFileSync16(path39.join(evidenceDir, `${rep}-inspect-${i}-ref.png`), zoomCrop(ref, rect));
+        writeFileSync16(path39.join(evidenceDir, `${rep}-inspect-${i}-render.png`), zoomCrop(render, rect));
       } catch {
         continue;
       }
@@ -12275,7 +12813,7 @@ async function runInspect(opts) {
       `<section><h2>${esc(rep)}</h2><div class="full"><span><em>recorded</em><img src="./${rep}-ref.png"></span><span><em>rendered</em><img src="./${rep}-render.png"></span><span><em>diff</em><img src="./${rep}-diff.png"></span></div>` + (cells.length > 0 ? `<div class="grid">${cells.join("")}</div>` : `<p class="none">no small recorded nodes in this config's sweep</p>`) + `</section>`
     );
   }
-  const sheet = path38.join(evidenceDir, "inspect.html");
+  const sheet = path39.join(evidenceDir, "inspect.html");
   writeFileSync16(
     sheet,
     `<!doctype html><meta charset="utf-8"><title>${esc(manifest.name)} \u2014 tendril inspect</title><style>
@@ -12353,17 +12891,17 @@ __export(generate_recorded_exports, {
   runGenerateRecorded: () => runGenerateRecorded
 });
 import { confirm as confirm3, isCancel as isCancel3 } from "@clack/prompts";
-import { existsSync as existsSync32, readFileSync as readFileSync28 } from "node:fs";
-import path39 from "node:path";
+import { existsSync as existsSync33, readFileSync as readFileSync29 } from "node:fs";
+import path40 from "node:path";
 async function runGenerateRecorded(opts) {
   const callerCwd = process.env["INIT_CWD"] ?? process.cwd();
-  const outDirAbs = path39.resolve(callerCwd, opts.out);
-  const recordedAsPath = path39.resolve(callerCwd, opts.recorded);
+  const outDirAbs = path40.resolve(callerCwd, opts.out);
+  const recordedAsPath = path40.resolve(callerCwd, opts.recorded);
   let task;
   let taskName;
   let authoredApi;
   let composition;
-  const isSet = existsSync32(path39.join(recordedAsPath, "recording-set.json"));
+  const isSet = existsSync33(path40.join(recordedAsPath, "recording-set.json"));
   const registry = TASKS[opts.recorded];
   if (registry !== void 0 && !isSet) {
     task = registry;
@@ -12372,7 +12910,7 @@ async function runGenerateRecorded(opts) {
     try {
       const authored = authorTaskFromSet(recordedAsPath);
       task = authored.task;
-      taskName = path39.basename(recordedAsPath);
+      taskName = path40.basename(recordedAsPath);
       authoredApi = authored.api;
       const roles = RolesSchema.safeParse(loadManifest(recordedAsPath).roles);
       if (roles.success) composition = roles.data;
@@ -12406,7 +12944,7 @@ async function runGenerateRecorded(opts) {
     warn(opts, `font weights (advisory): the recording implies weights ${g.declared.join(", ")} for "${g.family}" \u2014 cache provides ${g.provided.join(", ")}; nearest-weight rendering may shift stroke density (certification stays family-gated; implied weights can leak across families)`);
   }
   const missing = task.configs.filter(
-    (c) => !existsSync32(path39.join(task.set, c.rep, "get_screenshot.json")) || !existsSync32(path39.join(task.set, c.rep, "get_metadata.json")) || !existsSync32(path39.join(task.set, c.rep, "get_design_context.json"))
+    (c) => !existsSync33(path40.join(task.set, c.rep, "get_screenshot.json")) || !existsSync33(path40.join(task.set, c.rep, "get_metadata.json")) || !existsSync33(path40.join(task.set, c.rep, "get_design_context.json"))
   );
   if (missing.length > 0) {
     fail(opts, ExitCode.RecordingIncomplete, {
@@ -12476,8 +13014,8 @@ async function runGenerateRecorded(opts) {
 ` : `${line}
 `);
   if (opts.dryRun) {
-    emitData(opts, { dryRun: true, task: taskName, model: modelId, consent, wouldWrite: path39.join(outDirAbs, taskName) }, () => {
-      process.stdout.write(`dry-run: nothing sent, nothing written (would write ${path39.join(outDirAbs, taskName)})
+    emitData(opts, { dryRun: true, task: taskName, model: modelId, consent, wouldWrite: path40.join(outDirAbs, taskName) }, () => {
+      process.stdout.write(`dry-run: nothing sent, nothing written (would write ${path40.join(outDirAbs, taskName)})
 `);
     });
     return;
@@ -12500,10 +13038,10 @@ async function runGenerateRecorded(opts) {
       });
     }
   }
-  const bundleDir = path39.join(outDirAbs, taskName);
-  if (existsSync32(path39.join(bundleDir, "component.json"))) {
+  const bundleDir = path40.join(outDirAbs, taskName);
+  if (existsSync33(path40.join(bundleDir, "component.json"))) {
     try {
-      const prior = readBundleManifest(readFileSync28(path39.join(bundleDir, "component.json"), "utf8")).manifest;
+      const prior = readBundleManifest(readFileSync29(path40.join(bundleDir, "component.json"), "utf8")).manifest;
       if (prior !== void 0 && prior.provenance.recordingSet.hash !== recordingSetHash(task.set, task.configs)) {
         fail(opts, ExitCode.InputValidation, {
           error: `${bundleDir} already holds a bundle bound to recording set "${prior.provenance.recordingSet.path}" \u2014 generating here against a different set would silently rewrite its verification identity`,
@@ -12669,7 +13207,7 @@ init_invocation();
 init_output();
 import { intro, isCancel, outro, password } from "@clack/prompts";
 import fs from "node:fs";
-import path24 from "node:path";
+import path25 from "node:path";
 var INIT_DESCRIPTION = {
   name: "init",
   summary: "Configure Figma and OpenRouter credentials in .env (idempotent).",
@@ -12706,7 +13244,7 @@ async function runInit(flags) {
     printDescription(INIT_DESCRIPTION);
     return;
   }
-  const envPath = path24.resolve(process.cwd(), ".env");
+  const envPath = path25.resolve(process.cwd(), ".env");
   const existing = fs.existsSync(envPath) ? parseEnv(fs.readFileSync(envPath, "utf8")) : /* @__PURE__ */ new Map();
   let figmaToken = flags.figmaToken ?? existing.get(ENV_KEYS.figma);
   let openrouterKey = flags.openrouterKey ?? existing.get(ENV_KEYS.openrouter);
@@ -12727,7 +13265,7 @@ async function runInit(flags) {
   next.set(ENV_KEYS.figma, figmaToken);
   next.set(ENV_KEYS.openrouter, openrouterKey);
   const changed = existing.get(ENV_KEYS.figma) !== next.get(ENV_KEYS.figma) || existing.get(ENV_KEYS.openrouter) !== next.get(ENV_KEYS.openrouter);
-  const gitignorePath = path24.resolve(process.cwd(), ".gitignore");
+  const gitignorePath = path25.resolve(process.cwd(), ".gitignore");
   const gitignore = fs.existsSync(gitignorePath) ? fs.readFileSync(gitignorePath, "utf8") : "";
   const gitignoreCoversEnv = gitignore.split("\n").some((line) => [".env", ".env", ".env*"].includes(line.trim()));
   if (flags.dryRun) {
@@ -12783,14 +13321,14 @@ init_invocation();
 init_output();
 init_entitlement();
 import { confirm as confirm2, isCancel as isCancel2 } from "@clack/prompts";
-import { readFileSync as readFileSync15, readdirSync as readdirSync4, existsSync as existsSync19 } from "node:fs";
+import { readFileSync as readFileSync16, readdirSync as readdirSync5, existsSync as existsSync20 } from "node:fs";
 
 // packages/cli/src/pipeline.ts
 init_src2();
 init_src4();
 init_src6();
 import { mkdirSync as mkdirSync5, writeFileSync as writeFileSync8 } from "node:fs";
-import path25 from "node:path";
+import path26 from "node:path";
 
 // packages/cli/src/assets-module.ts
 init_src();
@@ -13126,7 +13664,7 @@ async function runGenerationPipeline(input) {
   });
   const written = [];
   if (!input.dryRun) {
-    const dir = path25.resolve(input.outDir, semantics.componentName);
+    const dir = path26.resolve(input.outDir, semantics.componentName);
     mkdirSync5(dir, { recursive: true });
     const files = {
       // Bundle-local tokens: THE emission the component's CSS resolves
@@ -13150,13 +13688,13 @@ async function runGenerationPipeline(input) {
 `
     };
     for (const [name, content] of Object.entries(files)) {
-      const filePath = path25.join(dir, name);
+      const filePath = path26.join(dir, name);
       writeFileSync8(filePath, content);
       written.push(filePath);
     }
     for (const artifact of emitTokenArtifacts(input.mapping)) {
-      const filePath = path25.resolve(input.outDir, artifact.path);
-      mkdirSync5(path25.dirname(filePath), { recursive: true });
+      const filePath = path26.resolve(input.outDir, artifact.path);
+      mkdirSync5(path26.dirname(filePath), { recursive: true });
       writeFileSync8(filePath, artifact.content);
       written.push(filePath);
     }
@@ -13215,7 +13753,7 @@ var GENERATE_DESCRIPTION = {
 function resolveProvidedSource(flags, contextFile) {
   let raw;
   try {
-    raw = readFileSync15(contextFile, "utf8");
+    raw = readFileSync16(contextFile, "utf8");
   } catch {
     fail(flags, ExitCode.InputValidation, {
       error: `Cannot read context file "${contextFile}".`,
@@ -13335,11 +13873,11 @@ token mapping (${mapping.flat.length} variables):
   let initialCode;
   let initialSemantics;
   try {
-    if (existsSync19(flags.out)) {
-      for (const entry of readdirSync4(flags.out)) {
+    if (existsSync20(flags.out)) {
+      for (const entry of readdirSync5(flags.out)) {
         const cjPath = `${flags.out}/${entry}/component.json`;
-        if (!existsSync19(cjPath)) continue;
-        const cj = JSON.parse(readFileSync15(cjPath, "utf8"));
+        if (!existsSync20(cjPath)) continue;
+        const cj = JSON.parse(readFileSync16(cjPath, "utf8"));
         if (cj.name !== void 0 && Array.isArray(cj.props)) {
           previousApi = JSON.stringify({
             componentName: cj.name,
@@ -13347,14 +13885,14 @@ token mapping (${mapping.flat.length} variables):
           });
           const tsxPath = `${flags.out}/${entry}/${cj.name}.tsx`;
           const cssPath = `${flags.out}/${entry}/${cj.name}.css`;
-          if (flags.refine && existsSync19(tsxPath) && existsSync19(cssPath)) {
+          if (flags.refine && existsSync20(tsxPath) && existsSync20(cssPath)) {
             initialCode = {
-              tsx: readFileSync15(tsxPath, "utf8"),
-              css: readFileSync15(cssPath, "utf8")
+              tsx: readFileSync16(tsxPath, "utf8"),
+              css: readFileSync16(cssPath, "utf8")
             };
             const semPath = `${flags.out}/${entry}/semantics.json`;
-            if (existsSync19(semPath)) {
-              initialSemantics = JSON.parse(readFileSync15(semPath, "utf8"));
+            if (existsSync20(semPath)) {
+              initialSemantics = JSON.parse(readFileSync16(semPath, "utf8"));
             }
           }
           break;
@@ -13631,6 +14169,23 @@ function buildProgram() {
       ...local["face"] !== void 0 ? { face: Number(local["face"]) } : {}
     });
   });
+  fonts.command("discover").description("List faces installed on THIS machine (name-table parse; no OS tools, no network). Refusal-class, italic and variable faces are listed with why they cannot be cached.").argument("[family]", "family to match exactly (case/space-insensitive); omit to list everything").option("--cache <dir>", "cache directory (default: the per-user font cache)").action(async (family, _o, cmd) => {
+    const flags = globalFlags(cmd.parent.parent);
+    const { runFontsDiscover: runFontsDiscover2 } = await Promise.resolve().then(() => (init_fonts(), fonts_exports));
+    runFontsDiscover2({ ...flags, cacheDir: cmd.opts()["cache"] ?? DEFAULT_FONT_CACHE, ...family !== void 0 ? { family } : {} });
+  });
+  fonts.command("add-system").description("Cache a family from the installed fonts so a licensed kit can be SCORED locally. Licence lands as unknown: bundles declare the face; its bytes never ship.").argument("<family>", "family exactly as fonts discover lists it").option("--weights <w...>", "only these numeric weights (default: every eligible static upright weight)").option("--set <dir>", "recording set to verify the family spelling against").option("--cache <dir>", "cache directory (default: the per-user font cache)").action(async (family, _o, cmd) => {
+    const flags = globalFlags(cmd.parent.parent);
+    const local = cmd.opts();
+    const { runFontsAddSystem: runFontsAddSystem2 } = await Promise.resolve().then(() => (init_fonts(), fonts_exports));
+    runFontsAddSystem2({
+      ...flags,
+      family,
+      cacheDir: local["cache"] ?? DEFAULT_FONT_CACHE,
+      ...local["weights"] !== void 0 ? { weights: local["weights"].map(Number) } : {},
+      ...local["set"] !== void 0 ? { set: local["set"] } : {}
+    });
+  });
   fonts.command("status").option("--lock <file>", "hash lock to verify against (e.g. packages/verify/fixtures/fonts.lock.json)").option("--cache <dir>", "cache directory (default: the per-user font cache)").action(async (_o, cmd) => {
     const flags = globalFlags(cmd.parent.parent);
     const local = cmd.opts();
@@ -13681,7 +14236,7 @@ function buildProgram() {
       ...local["out"] !== void 0 ? { out: local["out"] } : {}
     });
   });
-  program.command("permissions").description("Install (or print) the Claude Code permission allowlist for the Tendril pipeline (tendril + Figma MCP tools) \u2014 no more transcribing tool names from prompts.").option("--claude", "Claude Code settings format (the default and currently only format)").option("--write", "merge the per-tool entries into .claude/settings.local.json in the current project (idempotent; never touches other keys)").option("--user", "with --write: target ~/.claude/settings.json (every project) instead").option("--mcp-url <url>", "Figma MCP endpoint to list live tool names from").action(async (_o, cmd) => {
+  program.command("permissions").description("Install (or print) the Claude Code permission allowlist for the Tendril pipeline (tendril + Figma MCP tools) \u2014 no more transcribing tool names from prompts.").option("--claude", "Claude Code settings format (the default and currently only format)").option("--write", "merge the per-tool entries into .claude/settings.local.json in the current project (idempotent; never touches other keys)").option("--user", "with --write: target ~/.claude/settings.json \u2014 MCP tool entries only; shell and Write/Edit grants stay project-local").option("--mcp-url <url>", "Figma MCP endpoint to list live tool names from").option("--figma-prefix <prefix>", "the session's real Figma MCP entry prefix (e.g. mcp__figma-remote) when it is not the plugin default").option("--tendril-prefix <prefix>", "the session's real tendril MCP entry prefix (e.g. mcp__tendril for claude mcp add installs)").action(async (_o, cmd) => {
     const flags = globalFlags(cmd.parent);
     const local = cmd.opts();
     const { runPermissions: runPermissions2 } = await Promise.resolve().then(() => (init_permissions(), permissions_exports));
@@ -13689,7 +14244,9 @@ function buildProgram() {
       ...flags,
       ...local["write"] !== void 0 ? { write: local["write"] } : {},
       ...local["user"] !== void 0 ? { user: local["user"] } : {},
-      ...local["mcpUrl"] !== void 0 ? { mcpUrl: local["mcpUrl"] } : {}
+      ...local["mcpUrl"] !== void 0 ? { mcpUrl: local["mcpUrl"] } : {},
+      ...local["figmaPrefix"] !== void 0 ? { figmaPrefix: local["figmaPrefix"] } : {},
+      ...local["tendrilPrefix"] !== void 0 ? { tendrilPrefix: local["tendrilPrefix"] } : {}
     });
   });
   program.command("inspect").description("Build an eye-verifiable detail sheet from verify evidence: magnified recorded-vs-rendered crops of every small recorded node (icons, controls, marks) plus full-frame triples, in one static HTML page.").argument("<bundleDir>", "bundle directory with component.json and verify-evidence").option("--set <dir>", "recording set override (default: the bundle's provenance path)").option("--max-area <px2>", "node area ceiling for the detail sweep", "1024").action(async (bundleDir, _o, cmd) => {