@tendrilapp/cli 0.1.47 → 0.1.49

package/dist/tendril.js

@@ -842,9 +842,12 @@ import { existsSync } from "node:fs";
 import path from "node:path";
 import { z as z4 } from "zod";
 function resolveRepEnvelopePath(setDir, slug, kind) {
-  const mcp = path.join(setDir, slug, kind === "metadata" ? "get_metadata.json" : "get_screenshot.json");
+  return resolveRepEnvelopePathIn(path.join(setDir, slug), kind);
+}
+function resolveRepEnvelopePathIn(repDir, kind) {
+  const mcp = path.join(repDir, kind === "metadata" ? "get_metadata.json" : "get_screenshot.json");
   if (existsSync(mcp)) return mcp;
-  const rest = path.join(setDir, slug, kind === "metadata" ? REST_METADATA_FILE : REST_SCREENSHOT_FILE);
+  const rest = path.join(repDir, kind === "metadata" ? REST_METADATA_FILE : REST_SCREENSHOT_FILE);
   return existsSync(rest) ? rest : mcp;
 }
 function repEnvelopeExists(setDir, slug, kind) {
@@ -1670,7 +1673,7 @@ function effectivelyInvisible(node) {
   return false;
 }
 function repVisibility(setDir, slug) {
-  const file = path3.join(setDir, slug, "get_metadata.json");
+  const file = resolveRepEnvelopePathIn(path3.join(setDir, slug), "metadata");
   if (!existsSync3(file)) return void 0;
   let roots;
   try {
@@ -1721,6 +1724,7 @@ var init_visibility = __esm({
   "packages/figma/src/recording/visibility.ts"() {
     "use strict";
     init_normalize();
+    init_rest_envelopes();
     init_session();
     normalizedLayerName = (name) => name.toLowerCase().replace(/[^a-z0-9]/g, "");
     invisibleInEveryPose = (v) => v.presentIn.length > 0 && v.visibleIn.length === 0;
@@ -1778,7 +1782,7 @@ function buildComposeIndex(roots, depth = 3) {
     for (const rep of manifest.reps) {
       variantNodeIds.add(rep.nodeId);
       repSlugByVariantNode.set(rep.nodeId, rep.slug);
-      const metaFile = path4.join(dir, rep.slug, "get_metadata.json");
+      const metaFile = resolveRepEnvelopePathIn(path4.join(dir, rep.slug), "metadata");
       if (!existsSync4(metaFile)) continue;
       try {
         const text = envelopeTextContent(JSON.parse(readFileSync3(metaFile, "utf8")));
@@ -1837,8 +1841,31 @@ function emissionTails(setDir, repSlug) {
   }
   return byHead;
 }
+function restInstancePoses(setDir, repSlug, nodeId) {
+  const repDir = path4.join(setDir, repSlug);
+  if (!resolveRepEnvelopePathIn(repDir, "metadata").endsWith(REST_METADATA_FILE)) return /* @__PURE__ */ new Map();
+  const file = path4.join(repDir, REST_NODES_FILE);
+  if (!existsSync4(file)) return /* @__PURE__ */ new Map();
+  let doc;
+  try {
+    const parsed = JSON.parse(readFileSync3(file, "utf8"));
+    doc = parsed.nodes?.[nodeId]?.document;
+  } catch {
+    return /* @__PURE__ */ new Map();
+  }
+  const out = /* @__PURE__ */ new Map();
+  const walk2 = (n) => {
+    if (n.type === "INSTANCE") {
+      if (typeof n.id === "string" && typeof n.componentId === "string") out.set(n.id, n.componentId);
+      return;
+    }
+    if (Array.isArray(n.children)) for (const c of n.children) walk2(c);
+  };
+  if (doc !== null && typeof doc === "object") walk2(doc);
+  return out;
+}
 function hostInstances(setDir, repSlug) {
-  const metaFile = path4.join(setDir, repSlug, "get_metadata.json");
+  const metaFile = resolveRepEnvelopePathIn(path4.join(setDir, repSlug), "metadata");
   if (!existsSync4(metaFile)) return [];
   try {
     const text = envelopeTextContent(JSON.parse(readFileSync3(metaFile, "utf8")));
@@ -1867,10 +1894,11 @@ function composeReport(index) {
       }
     }
     for (const [variantNodeId, slug] of host.repSlugByVariantNode) {
-      void variantNodeId;
       const instances = hostInstances(host.dir, slug);
       if (instances.length === 0) continue;
       const tailsByHead = emissionTails(host.dir, slug);
+      const cidByInstance = restInstancePoses(host.dir, slug, variantNodeId);
+      const repIsMcpRecorded = !resolveRepEnvelopePathIn(path4.join(host.dir, slug), "metadata").endsWith(REST_METADATA_FILE);
       for (const inst of instances) {
         if (visibleEver.get(inst.id) !== true) {
           edges.push({
@@ -1887,10 +1915,12 @@ function composeReport(index) {
           continue;
         }
         const tails = tailsByHead.get(inst.id) ?? /* @__PURE__ */ new Map();
+        const cid = cidByInstance.get(inst.id);
         const disclosures = [];
         const refused = [];
         const idCands = index.filter((c) => {
           if (c.dir === host.dir || sameComponent(c, host)) return false;
+          if (cid !== void 0 && c.variantNodeIds.has(cid)) return true;
           for (const t of tails.keys()) if (c.ownIds.has(t)) return true;
           return false;
         });
@@ -1938,7 +1968,15 @@ function composeReport(index) {
               partners: nameProps.map((p) => ({ dir: p.dir, displayName: p.displayName, ...p.figmaFile !== void 0 ? { figmaFile: p.figmaFile } : {} })),
               disclosures: [
                 ...disclosures,
-                `NAME-ONLY proposal \u2014 identity unproven, name evidence never auto-joins: instance "${inst.name}" names ${nameProps.map(kitLabel).join(" / ")}. Name-only edges are NOT confirmable (there is nothing sound to confirm); record the partner so an id-backed join can form, or ignore`
+                `NAME-ONLY proposal \u2014 identity unproven, name evidence never auto-joins: instance "${inst.name}" names ${nameProps.map(kitLabel).join(" / ")}. Name-only edges are NOT confirmable (there is nothing sound to confirm); record the partner so an id-backed join can form, or ignore`,
+                // The remediation is CONDITIONAL (review): componentId
+                // is a host-file-namespace id, so the promise holds
+                // only for same-file partners — and only when the host
+                // rep was recorded over MCP (a REST-recorded rep with
+                // no binding genuinely has none to capture).
+                ...repIsMcpRecorded && host.figmaFile !== void 0 && nameProps.some((p) => p.figmaFile === host.figmaFile) ? [
+                  `this host records over MCP, so Figma's instance\u2192component binding was never captured \u2014 re-recording the HOST over the REST channel makes this pair id-backed (a fresh recording, then a full host regeneration and re-verify)`
+                ] : []
               ]
             });
           } else if (disclosures.length > 0) {
@@ -1961,8 +1999,10 @@ function composeReport(index) {
         const group = eligible[0];
         const ownedDepths = [];
         for (const [t, d] of tails) if (group.some((m) => m.ownIds.has(t))) ownedDepths.push(d);
-        const substitution = ownedDepths.length > 0 && ownedDepths.every((d) => d === 1);
+        const cidBacked = cid !== void 0 && group.some((m) => m.variantNodeIds.has(cid));
+        const substitution = (ownedDepths.length > 0 || cidBacked) && ownedDepths.every((d) => d === 1);
         const poseVariants = /* @__PURE__ */ new Set();
+        if (cidBacked) poseVariants.add(cid);
         for (const m of group) {
           for (const [t, d] of tails) {
             if (d !== 1 || !m.ownIds.has(t)) continue;
@@ -1973,6 +2013,9 @@ function composeReport(index) {
             }
           }
         }
+        if (cid !== void 0 && !cidBacked && ownedDepths.length > 0) {
+          disclosures.push(`Figma's instance binding names an UNRECORDED variant (${cid}) \u2014 this join stands on emission-id evidence alone`);
+        }
         for (const p of nameProps) {
           if (!group.some((m) => sameComponent(m, p))) {
             disclosures.push(`NAME DISAGREES: instance name "${inst.name}" matches ${kitLabel(p)} while id evidence joins ${kitLabel(group[0])} \u2014 if the id join looks wrong, this is the signal`);
@@ -2016,7 +2059,7 @@ function composeReport(index) {
           },
           disclosures: [
             ...disclosures,
-            "substitution-grade: every owned tail at depth 1; pixel-neutrality is NOT asserted here \u2014 instance overrides are measured real, and a per-region check is still future work (whole-frame pixels remain the evidence for composed regions)"
+            `substitution-grade (${[...ownedDepths.length > 0 ? ["every owned emission id at depth 1"] : [], ...cidBacked ? ["Figma's instance\u2192component binding (componentId), recorded verbatim over REST"] : []].join(" + ")}); pixel-neutrality is NOT asserted here \u2014 instance overrides are measured real, and a per-region check is still future work (whole-frame pixels remain the evidence for composed regions)`
           ]
         });
       }
@@ -2104,7 +2147,7 @@ function confirmedCompositionStatus(hostSet) {
       status: ok ? stale ? "stale-supported" : "supported" : stale ? "stale-unsupported" : "unsupported",
       instances: entry.instances,
       affectedReps: ok ? [] : [...new Set(unsupported.map((i) => i.hostRep))],
-      detail: ok ? stale ? "the partner manifest changed since the decision (pinned bytes differ) \u2014 the CURRENT recordings still support every confirmed edge" : "the recordings support every confirmed edge (identity, rep attribution and pose re-derived)" : `${unsupported.length} confirmed instance(s) are NOT supported by the current recordings (${unsupported.map((i) => `${i.hostRep}/${i.instanceId}`).join(", ")}) \u2014 a confirmed composition the evidence does not derive; ${remediation}. If the instance is HIDDEN in every recorded pose, this confirmation predates the visibility principle (Cycle A) and re-running compose cannot re-open it (asked-once): either re-record a pose that SHOWS the instance, or remove this entry from the manifest's compositions array by hand \u2014 a retire flag is a named follow-up`
+      detail: ok ? stale ? "the partner manifest changed since the decision (pinned bytes differ) \u2014 the CURRENT recordings still support every confirmed edge" : "the recordings support every confirmed edge (identity, rep attribution and pose re-derived)" : `${unsupported.length} confirmed instance(s) are NOT supported by the current recordings (${unsupported.map((i) => `${i.hostRep}/${i.instanceId}`).join(", ")}) \u2014 a confirmed composition the evidence does not derive; ${remediation}. If the instance is HIDDEN in every recorded pose, this confirmation predates the visibility principle (Cycle A) and re-running compose cannot re-open it (asked-once): either re-record a pose that SHOWS the instance, or remove this entry from the manifest's compositions array by hand \u2014 a retire flag is a named follow-up${unsupported.some((i) => !existsSync4(path4.join(hostSet, i.hostRep, REST_NODES_FILE))) ? ". If this pair was confirmed from REST-recorded evidence and the host was since re-recorded over MCP, the evidence CLASS is gone rather than broken \u2014 re-record the host over the REST channel to restore it" : ""}`
     });
   }
   return { rows, ...malformedEntries.length > 0 ? { malformed: malformedEntries.join("; ") } : {} };
@@ -2112,11 +2155,111 @@ function confirmedCompositionStatus(hostSet) {
 function createHashHex(bytes) {
   return createHash2("sha256").update(bytes).digest("hex");
 }
+function liteIdentity(dir) {
+  try {
+    const manifest = loadManifest(dir);
+    return {
+      dir,
+      displayName: manifest.component,
+      ...manifest.figmaFile !== void 0 ? { figmaFile: manifest.figmaFile } : {},
+      ...manifest.componentSetNode !== void 0 ? { componentSetNode: manifest.componentSetNode } : {},
+      variantNodeIds: new Set(manifest.reps.map((r) => r.nodeId)),
+      repSlugByVariantNode: new Map(manifest.reps.map((r) => [r.nodeId, r.slug])),
+      ownIdsByRep: /* @__PURE__ */ new Map(),
+      ownIds: /* @__PURE__ */ new Set()
+    };
+  } catch {
+    return void 0;
+  }
+}
+function partnerOpportunities(partnerSet, roots) {
+  const abs = path4.resolve(partnerSet);
+  const index = buildComposeIndex([.../* @__PURE__ */ new Set([...roots.map((r) => path4.resolve(r)), abs])]);
+  const partnerEntry = index.find((e) => path4.resolve(e.dir) === abs);
+  if (partnerEntry === void 0) return { opportunities: [], hostsWithUnreadableDecisions: [] };
+  const entryFor = (dir) => index.find((e) => path4.resolve(e.dir) === path4.resolve(dir)) ?? liteIdentity(path4.resolve(dir));
+  const isPartner = (dirs) => dirs.some((p) => {
+    if (path4.resolve(p.dir) === abs) return true;
+    const e = entryFor(p.dir);
+    return e !== void 0 && sameComponent(e, partnerEntry);
+  });
+  const edges = composeReport(index);
+  const byHost = /* @__PURE__ */ new Map();
+  for (const e of edges) {
+    if (path4.resolve(e.hostSet) === abs) continue;
+    if (e.kind !== "substitution" && e.kind !== "ask" && e.kind !== "proposal") continue;
+    if (!isPartner(e.partners)) continue;
+    const list = byHost.get(e.hostSet) ?? [];
+    list.push(e);
+    byHost.set(e.hostSet, list);
+  }
+  const opportunities = [];
+  const unreadable = [];
+  for (const [hostSet, hostEdges] of byHost) {
+    let decided = false;
+    let malformed = 0;
+    try {
+      const raw = JSON.parse(readFileSync3(path4.join(hostSet, "recording-set.json"), "utf8"));
+      for (const entry of Array.isArray(raw["compositions"]) ? raw["compositions"] : []) {
+        const parsed = CompositionEntrySchema.safeParse(entry);
+        if (!parsed.success) {
+          malformed += 1;
+          continue;
+        }
+        for (const rel of Object.keys(parsed.data.partner.manifestSha256).map(fromStoredRel)) {
+          const e = entryFor(path4.resolve(hostSet, rel));
+          if (e !== void 0 && sameComponent(e, partnerEntry)) decided = true;
+        }
+      }
+    } catch {
+      malformed += 1;
+    }
+    if (malformed > 0) unreadable.push({ hostSet, unreadable: malformed });
+    if (decided) continue;
+    const hostName = index.find((e) => path4.resolve(e.dir) === path4.resolve(hostSet))?.displayName ?? path4.basename(hostSet);
+    const byKind = { substitution: [], ask: [], proposal: [] };
+    for (const e of hostEdges) byKind[e.kind].push(e);
+    if (byKind.substitution.length > 0) {
+      const dirs = byKind.substitution[0].partners.map((p) => p.dir);
+      opportunities.push({
+        hostSet,
+        hostDisplayName: hostName,
+        kind: "confirmable",
+        pairKey: pairKeyFor(path4.resolve(hostSet), dirs),
+        instances: byKind.substitution.length,
+        hostReps: [...new Set(byKind.substitution.map((e) => e.hostRep))],
+        disclosures: [...new Set(byKind.substitution.flatMap((e) => e.disclosures))]
+      });
+    }
+    if (byKind.ask.length > 0) {
+      opportunities.push({
+        hostSet,
+        hostDisplayName: hostName,
+        kind: "ambiguous",
+        instances: byKind.ask.length,
+        hostReps: [...new Set(byKind.ask.map((e) => e.hostRep))],
+        disclosures: [...new Set(byKind.ask.flatMap((e) => e.disclosures))]
+      });
+    }
+    if (byKind.proposal.length > 0) {
+      opportunities.push({
+        hostSet,
+        hostDisplayName: hostName,
+        kind: "name-only",
+        instances: byKind.proposal.length,
+        hostReps: [...new Set(byKind.proposal.map((e) => e.hostRep))],
+        disclosures: [...new Set(byKind.proposal.flatMap((e) => e.disclosures))]
+      });
+    }
+  }
+  return { opportunities, hostsWithUnreadableDecisions: unreadable };
+}
 var CompositionEntrySchema, norm, FOOTER, kitLabel, toPosixRel, fromStoredRel, pairKeyFor;
 var init_compose = __esm({
   "packages/figma/src/recording/compose.ts"() {
     "use strict";
     init_session();
+    init_rest_envelopes();
     init_normalize();
     init_visibility();
     CompositionEntrySchema = z6.object({
@@ -6647,7 +6790,7 @@ var init_bundle_files = __esm({
 // packages/metadata/src/verify-report.ts
 function verifyReportForTransport(report, bundleName) {
   const { dir: _dir, ...evidence } = report.evidence;
-  const { eyeCheck: _eyeCheck, ...rest } = report;
+  const { eyeCheck: _eyeCheck, next: _next, composeOpportunities: _composeOpportunities, ...rest } = report;
   return { ...rest, bundle: bundleName, evidence };
 }
 function nonEmptyArray(value) {
@@ -11631,7 +11774,8 @@ var init_brief = __esm({
 import { existsSync as existsSync29, readFileSync as readFileSync26, readdirSync as readdirSync10 } from "node:fs";
 import path36 from "node:path";
 function repText(set, rep, tool) {
-  const env = JSON.parse(readFileSync26(path36.join(set, rep, `${tool}.json`), "utf8"));
+  const file = tool === "get_metadata" ? resolveRepEnvelopePath(set, rep, "metadata") : tool === "get_screenshot" ? resolveRepEnvelopePath(set, rep, "screenshot") : path36.join(set, rep, `${tool}.json`);
+  const env = JSON.parse(readFileSync26(file, "utf8"));
   return tool === "get_design_context" ? envelopeFirstTextPart(env) : envelopeTextContent(env);
 }
 function refPngDims(set, rep) {
@@ -11791,7 +11935,6 @@ var init_segments = __esm({
   "packages/generate/src/segments.ts"() {
     "use strict";
     init_src();
-    init_src();
     cssIdent = (name) => name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
   }
 });
@@ -14434,7 +14577,16 @@ function compositionPairsFor(hostSet, roots) {
     else invalid++;
   }
   const decidedKeys = new Set(standing.map((c) => fromStoredRel(c.partner.key)));
-  return { open: pairs.filter((p) => !decidedKeys.has(p.key)), standing, invalid, ...skippedParent !== void 0 ? { skippedParent } : {} };
+  const proposalRows = /* @__PURE__ */ new Map();
+  for (const e of edges) {
+    if (e.hostSet !== hostSet || e.kind !== "proposal") continue;
+    const key = e.partners.map((p) => p.dir).sort().join("+");
+    const row = proposalRows.get(key) ?? { displayName: e.partners[0]?.displayName ?? e.instanceName, partnerDirs: e.partners.map((p) => p.dir), instances: 0, disclosures: [] };
+    row.instances += 1;
+    for (const d of e.disclosures) if (!row.disclosures.includes(d)) row.disclosures.push(d);
+    proposalRows.set(key, row);
+  }
+  return { open: pairs.filter((p) => !decidedKeys.has(p.key)), proposals: [...proposalRows.values()], standing, invalid, ...skippedParent !== void 0 ? { skippedParent } : {} };
 }
 function substitutionPairs(edges, hostSet) {
   const pairs = /* @__PURE__ */ new Map();
@@ -14879,7 +15031,7 @@ async function runRecordPlan(opts) {
     ...opts.figmaFile !== void 0 ? { figmaFile: opts.figmaFile } : {},
     ...setIdentity
   });
-  const channelNote = await assignRestChannel(opts.setDir, manifest, resumed);
+  const channelNote = await assignRestChannel(opts.setDir, manifest, resumed, opts.restClient);
   const defaultReports = reportAxisDefaults(symbols, Object.keys(defaults).length > 0 ? defaults : void 0);
   const toConfirm = resumed ? [] : defaultReports.filter((r) => (r.rule === "non-interaction" || r.rule === "frequency") && r.domain.length > 1);
   const interactionStatesToConfirm = recordsInteractionState(defaultReports) ? void 0 : interactionDisclosure(manifest.component, defaultReports);
@@ -15069,7 +15221,7 @@ async function runRecordPlan(opts) {
     }
   );
 }
-async function assignRestChannel(setDir, manifest, resumed) {
+async function assignRestChannel(setDir, manifest, resumed, injected) {
   const current = loadManifest(setDir);
   if (current.channel !== void 0) {
     return { active: true, probeReps: current.probeReps ?? [], note: "REST channel already assigned (frozen with the plan)" };
@@ -15085,7 +15237,7 @@ async function assignRestChannel(setDir, manifest, resumed) {
       note: "REST channel unavailable: the plan carries no --figma-file key \u2014 pass it (from the design URL) to record pixels+geometry over Figma REST and escape the MCP daily limit"
     };
   }
-  const client = await figmaRestClient();
+  const client = injected !== void 0 ? { ok: true, value: injected } : await figmaRestClient();
   if (!client.ok) {
     return client.kind === "no-credential" ? {
       active: false,
@@ -15146,7 +15298,7 @@ async function runRecordRestFetch(opts) {
       remediation: `Record them first: ${tendrilCommand(`record next --set ${opts.setDir}`)} names the calls.`
     });
   }
-  const client = await figmaRestClient();
+  const client = opts.restClient !== void 0 ? { ok: true, value: opts.restClient } : await figmaRestClient();
   if (!client.ok) {
     fail(opts, ExitCode.General, { error: client.refusal, code: `figma-rest-${client.kind}`, remediation: client.kind === "no-credential" ? `Run ${tendrilCommand("figma-connect")} once, then re-run this.` : "Fix what is named above, or fall back: remove `channel`/`probeReps` from recording-set.json to record over MCP." });
   }
@@ -15649,9 +15801,14 @@ function runRecordStatus(opts) {
   const composition = (() => {
     try {
       const setDir = path45.resolve(opts.setDir);
-      const { open, standing, invalid } = compositionPairsFor(setDir, [path45.dirname(setDir)]);
+      const { open, proposals, standing, invalid } = compositionPairsFor(setDir, [path45.dirname(setDir)]);
       return {
         openPairs: open.map((p) => ({ displayName: p.displayName, pairKey: p.key, instances: p.instances.length })),
+        // Name-only proposals (field, 2026-08-26): the host-side
+        // surface an MCP-recorded host embedding a later partner never
+        // had — not confirmable, but never silent either; the
+        // disclosures carry the conditional re-record remediation.
+        nameOnly: proposals.map((p) => ({ displayName: p.displayName, instances: p.instances, disclosures: p.disclosures })),
         confirmed: standing.filter((s) => s.status === "confirmed").length,
         declined: standing.filter((s) => s.status === "declined").length,
         invalid
@@ -15685,6 +15842,12 @@ function runRecordStatus(opts) {
       process.stdout.write(`COMPOSITION ${composition.confirmed} confirmed partner pair(s) on this set (composed pins apply at generation)
 `);
     }
+    if (!("unavailable" in composition) && composition.nameOnly.length > 0) {
+      for (const p of composition.nameOnly) {
+        process.stdout.write(`COMPOSITION NAME-ONLY: instance name matches recorded component ${p.displayName} (${p.instances} instance(s)) \u2014 identity unproven, NOT confirmable. ${p.disclosures.find((d) => d.includes("re-record")) ?? "Record id evidence to make it confirmable, or ignore."}
+`);
+      }
+    }
     if (!("unavailable" in composition) && composition.invalid > 0) {
       process.stdout.write(
         `COMPOSITION WARNING: ${composition.invalid} standing composition entr${composition.invalid === 1 ? "y is" : "ies are"} MALFORMED in recording-set.json \u2014 a corrupted DECLINE silently re-opens its pair; repair or remove the entry (it holds a human decision and is provenance-hashed)
@@ -16250,6 +16413,177 @@ var init_profile_input = __esm({
   }
 });
 
+// packages/cli/src/commands/inspect.ts
+var inspect_exports = {};
+__export(inspect_exports, {
+  INSPECT_DESCRIPTION: () => INSPECT_DESCRIPTION,
+  buildInspectSheet: () => buildInspectSheet,
+  runInspect: () => runInspect
+});
+import { existsSync as existsSync39, readFileSync as readFileSync35, writeFileSync as writeFileSync17 } from "node:fs";
+import path49 from "node:path";
+function readVerifyReport(evidenceDir) {
+  const p = path49.join(evidenceDir, VERIFY_REPORT_FILENAME);
+  if (!existsSync39(p)) return void 0;
+  try {
+    return JSON.parse(readFileSync35(p, "utf8"));
+  } catch {
+    return void 0;
+  }
+}
+function verdictBlock(report) {
+  if (report === void 0) {
+    return `<div class="verdict none"><h2>No verdict on file</h2><p>This evidence carries no <code>${VERIFY_REPORT_FILENAME}</code>, so these images are unlabelled pixels \u2014 nothing here says what passed. Re-run <code>tendril verify</code> to write one.</p></div>`;
+  }
+  const buckets = /* @__PURE__ */ new Map();
+  for (const c of report.configs) buckets.set(c.status, (buckets.get(c.status) ?? 0) + 1);
+  const split = [...buckets.entries()].map(([k, n]) => `<span class="tier t-${esc(k)}">${n} ${esc(k)}</span>`).join("");
+  const failed = report.behaviors.filter((b) => !b.pass);
+  return `<div class="verdict ${report.verdict === "verified" ? "ok" : "bad"}"><h2>${esc(report.verdict)} <small>at bar \u201C${esc(report.targetBar)}\u201D</small></h2><p class="tiers">${split}<span class="tier">${report.behaviors.length - failed.length}/${report.behaviors.length} behaviors</span></p>` + (failed.length > 0 ? `<ul class="fails">${failed.map((b) => `<li><code>${esc(b.id)}</code>${b.detail !== void 0 ? ` \u2014 ${esc(b.detail)}` : ""}</li>`).join("")}</ul>` : "") + (report.verdictCaveats.length > 0 ? `<h3>What was never asked</h3><ul class="caveats">${report.verdictCaveats.map((c) => `<li>${esc(c)}</li>`).join("")}</ul>` : `<p class="caveats">No caveats: every question this bar asks was answered.</p>`) + `</div>`;
+}
+function scoreLine(report, rep) {
+  const c = report?.configs.find((x) => x.rep === rep);
+  if (c === void 0) return "";
+  const ex = c.exact !== void 0 ? ` <span class="exact">measured ${c.exact.similarity.toFixed(6)} / ${c.exact.inkRecall.toFixed(6)}</span>` : "";
+  const why = Array.isArray(c.demotedBy) && c.demotedBy.length > 0 ? `<span class="demoted">demoted: ${esc(c.demotedBy.join("; "))}</span>` : "";
+  const err = typeof c.error === "string" ? `<span class="demoted">${esc(c.error)}</span>` : "";
+  return `<p class="scores"><span class="tier t-${esc(c.status)}">${esc(c.status)}</span> sim ${c.similarity} \xB7 ink ${c.inkRecall}${ex} ${why} ${err}</p>`;
+}
+async function runInspect(opts) {
+  if (opts.describe) {
+    printDescription(INSPECT_DESCRIPTION);
+    return;
+  }
+  const bundleDir = path49.resolve(opts.bundleDir);
+  const evidenceDir = path49.join(bundleDir, "verify-evidence");
+  const manifestPath2 = path49.join(bundleDir, "component.json");
+  if (!existsSync39(evidenceDir) || !existsSync39(manifestPath2)) {
+    fail(opts, ExitCode.InputValidation, {
+      error: `nothing to inspect in ${bundleDir} \u2014 ${existsSync39(manifestPath2) ? "no verify-evidence directory" : "no component.json"}`,
+      code: "no-evidence",
+      remediation: `Run \`${tendrilCommand(`verify ${bundleDir}`)}\` first \u2014 inspect reads the ref/render evidence that run writes.`
+    });
+  }
+  const { manifest } = readBundleManifest(readFileSync35(manifestPath2, "utf8"));
+  if (manifest === void 0) {
+    fail(opts, ExitCode.InputValidation, {
+      error: "component.json did not parse as a bundle manifest",
+      code: "no-mount-contract",
+      remediation: "Re-emit the bundle (score/verify rewrite component.json), then re-run inspect."
+    });
+  }
+  const setDir = path49.resolve(opts.set ?? manifest.provenance.recordingSet.path);
+  const report = readVerifyReport(evidenceDir);
+  const reps = Object.keys(manifest.propAdapter).filter((rep) => existsSync39(path49.join(evidenceDir, `${rep}-ref.png`)) && existsSync39(path49.join(evidenceDir, `${rep}-render.png`)));
+  if (reps.length === 0) {
+    fail(opts, ExitCode.InputValidation, {
+      error: "verify-evidence holds no ref/render pairs for this bundle's configs",
+      code: "no-evidence",
+      remediation: `Run \`${tendrilCommand(`verify ${bundleDir}`)}\` first \u2014 inspect reads the ref/render evidence that run writes.`
+    });
+  }
+  const { sheet, crops } = buildInspectSheet({ bundleDir, setDir, title: manifest.name, repCandidates: reps, report, ...opts.maxArea !== void 0 ? { maxArea: opts.maxArea } : {} });
+  emitData(opts, { sheet, configs: reps.length, crops }, () => {
+    process.stdout.write(`inspect sheet: ${sheet}
+${reps.length} config(s), ${crops} detail crop pair(s) \u2014 open the sheet and scan recorded vs rendered
+`);
+  });
+}
+function buildInspectSheet(input) {
+  const evidenceDir = path49.join(path49.resolve(input.bundleDir), "verify-evidence");
+  const setDir = input.setDir;
+  const report = input.report;
+  const reps = input.repCandidates.filter((rep) => existsSync39(path49.join(evidenceDir, `${rep}-ref.png`)) && existsSync39(path49.join(evidenceDir, `${rep}-render.png`)));
+  let crops = 0;
+  const sections = [];
+  for (const rep of reps) {
+    const ref = new Uint8Array(readFileSync35(path49.join(evidenceDir, `${rep}-ref.png`)));
+    const render = new Uint8Array(readFileSync35(path49.join(evidenceDir, `${rep}-render.png`)));
+    const nodes = smallSemanticNodes(setDir, rep, input.maxArea ?? 1024).slice(0, 12);
+    const cells = [];
+    for (const [i, n] of nodes.entries()) {
+      const rect = { x: n.x, y: n.y, w: n.w, h: n.h };
+      try {
+        writeFileSync17(path49.join(evidenceDir, `${rep}-inspect-${i}-ref.png`), zoomCrop(ref, rect));
+        writeFileSync17(path49.join(evidenceDir, `${rep}-inspect-${i}-render.png`), zoomCrop(render, rect));
+      } catch {
+        continue;
+      }
+      crops += 1;
+      cells.push(
+        `<figure><figcaption>${esc(n.name)} <code>${esc(n.id)}</code> \xB7 ${n.w}\xD7${n.h}</figcaption><div class="pair"><span><em>recorded</em><img src="./${rep}-inspect-${i}-ref.png" alt="recorded ${esc(n.name)}"></span><span><em>rendered</em><img src="./${rep}-inspect-${i}-render.png" alt="rendered ${esc(n.name)}"></span></div></figure>`
+      );
+    }
+    sections.push(
+      `<section><h2>${esc(rep)}</h2>` + scoreLine(report, rep) + `<div class="full"><span><em>recorded</em><img src="./${rep}-ref.png"></span><span><em>rendered</em><img src="./${rep}-render.png"></span><span><em>diff</em><img src="./${rep}-diff.png"></span></div>` + (cells.length > 0 ? `<div class="grid">${cells.join("")}</div>` : `<p class="none">no small recorded nodes in this config's sweep</p>`) + `</section>`
+    );
+  }
+  for (const c of report?.configs ?? []) {
+    if (reps.includes(c.rep)) continue;
+    sections.push(`<section class="missing"><h2>${esc(c.rep)}</h2>${scoreLine(report, c.rep)}<p class="none">No evidence images for this config \u2014 it was scored, but nothing was captured to look at.</p></section>`);
+  }
+  const sheet = path49.join(evidenceDir, "inspect.html");
+  writeFileSync17(
+    sheet,
+    `<!doctype html><meta charset="utf-8"><title>${esc(input.title)} \u2014 tendril inspect</title><style>
+body{font:14px/1.45 system-ui,sans-serif;margin:24px;background:#fff;color:#111}
+h1{font-size:20px} h2{font-size:16px;border-top:1px solid #ddd;padding-top:16px}
+.pair,.full{display:flex;gap:12px;flex-wrap:wrap;align-items:flex-start}
+.full img{max-width:400px;border:1px solid #ccc} .pair img{border:1px solid #ccc;image-rendering:pixelated}
+figure{margin:0 0 16px} figcaption{margin-bottom:4px} em{display:block;color:#666;font-style:normal;font-size:12px}
+.grid{display:flex;flex-wrap:wrap;gap:20px;margin-top:12px} .none{color:#666}
+.verdict{border:1px solid #ddd;border-left-width:5px;padding:12px 16px;margin:16px 0;background:#fafafa}
+.verdict.ok{border-left-color:#1a7f37} .verdict.bad{border-left-color:#b35900} .verdict.none{border-left-color:#999}
+.verdict h2{border:0;padding:0;margin:0 0 8px} .verdict h3{font-size:13px;margin:12px 0 4px;color:#444}
+.verdict small{font-weight:400;color:#666}
+.tiers{margin:0;display:flex;gap:8px;flex-wrap:wrap}
+.tier{display:inline-block;padding:1px 8px;border:1px solid #ccc;border-radius:10px;font-size:12px;background:#fff}
+.t-certified{border-color:#1a7f37;color:#1a7f37} .t-pass{border-color:#8a6d00;color:#8a6d00} .t-fail{border-color:#b3261e;color:#b3261e}
+.caveats,.fails{margin:4px 0 0;padding-left:20px;color:#444} .caveats li,.fails li{margin:2px 0}
+.scores{margin:4px 0 10px;color:#333} .exact{color:#666;font-size:12px} .demoted{color:#b3261e;font-size:12px;margin-left:8px}
+.missing{opacity:.85} .legend{white-space:pre-wrap;font:12px/1.4 ui-monospace,SFMono-Regular,Menlo,monospace;background:#fafafa;border:1px solid #ddd;padding:12px;overflow-x:auto}
+</style><h1>${esc(input.title)} \u2014 verdict and evidence</h1>
+${verdictBlock(report)}
+<p>Below, every crop is a recorded node small enough that global metrics weight it as a rounding error.
+Scan the pairs: anything present on the left and missing/invisible on the right is a defect,
+whatever the scores said. Verdicts come from <code>tendril verify</code> \u2014 this sheet only shows.</p>
+${sections.join("\n")}
+<section><h2>Diff colours</h2><div class="legend">${esc(DIFF_LEGEND_TEXT)}</div></section>
+`
+  );
+  return { sheet, configs: reps.length, crops };
+}
+var INSPECT_DESCRIPTION, esc;
+var init_inspect = __esm({
+  "packages/cli/src/commands/inspect.ts"() {
+    "use strict";
+    init_src3();
+    init_src4();
+    init_src5();
+    init_describe();
+    init_invocation();
+    init_output();
+    INSPECT_DESCRIPTION = {
+      name: "inspect",
+      summary: "Build an eye-verifiable detail sheet from verify evidence: magnified ref-vs-render crops of every small recorded node (icons, controls, marks).",
+      args: [{ name: "bundleDir", required: true, description: "bundle directory (must carry component.json and a verify-evidence dir from a prior `tendril verify`)" }],
+      flags: [
+        { flag: "--set <dir>", description: "recording set override (default: the bundle's provenance path)" },
+        { flag: "--max-area <px2>", description: "node area ceiling for the detail sweep", default: "1024" },
+        { flag: "--json", description: "Machine-readable output" }
+      ],
+      output: {
+        sheet: "string \u2014 path to the generated inspect.html",
+        configs: "number \u2014 configs with evidence found",
+        crops: "number \u2014 detail crop pairs written"
+      },
+      exitCodes: { 0: "sheet written", 3: "no verify evidence to inspect (run `tendril verify` first)" },
+      examples: ["tendril inspect ./src/components/Banner", "tendril inspect ./bundle --set ./tendril/recordings/banner"]
+    };
+    esc = (s) => s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+  }
+});
+
 // packages/cli/src/commands/verify.ts
 var verify_exports = {};
 __export(verify_exports, {
@@ -16273,8 +16607,8 @@ __export(verify_exports, {
   runVerify: () => runVerify,
   verdictCaveatsFor: () => verdictCaveatsFor
 });
-import { existsSync as existsSync39, readFileSync as readFileSync35, rmSync as rmSync7, writeFileSync as writeFileSync17 } from "node:fs";
-import path49 from "node:path";
+import { existsSync as existsSync40, readFileSync as readFileSync36, readdirSync as readdirSync16, rmSync as rmSync7, writeFileSync as writeFileSync18 } from "node:fs";
+import path50 from "node:path";
 function interactionCoverage(behaviors) {
   const parity = behaviors.filter((b) => b.id.startsWith("parity:"));
   const content = behaviors.filter((b) => b.id.startsWith("content-prop-renders("));
@@ -16512,15 +16846,17 @@ function compositionReport(input) {
     crops: input.crops ?? { unavailable: cropsUnavailable }
   };
 }
-function eyeCheck(bundleDir) {
-  return {
+function eyeCheck(bundleDir, sheet) {
+  const base = {
     command: tendrilCommand(`inspect "${bundleDir}"`),
-    sheetPath: path49.join(bundleDir, "verify-evidence", "inspect.html"),
+    sheetPath: path50.join(bundleDir, "verify-evidence", "inspect.html"),
     note: "magnified recorded-vs-rendered crops of every small node; scores cannot see shape. The command WRITES/refreshes the sheet at sheetPath \u2014 re-run it after every verify; an existing sheet may show stale crops."
   };
+  if (sheet === void 0) return base;
+  return { ...base, sheetBuilt: sheet.built, ...sheet.crops !== void 0 ? { sheetCrops: sheet.crops } : {}, ...sheet.error !== void 0 ? { sheetBuildError: sheet.error } : {} };
 }
 function evidenceArtifacts(evidenceDir, reps) {
-  const named = (name) => existsSync39(path49.join(evidenceDir, name)) ? name : null;
+  const named = (name) => existsSync40(path50.join(evidenceDir, name)) ? name : null;
   return {
     legend: named("diff-legend.txt"),
     configs: reps.map((rep) => {
@@ -16568,7 +16904,7 @@ function taskFromManifest(opts, manifest, setDir) {
   const adapterSlugs = Object.keys(manifest.propAdapter);
   const unmapped = recordedSlugs.filter((s) => !adapterSlugs.includes(s));
   const adapterOnly = adapterSlugs.filter((s) => !recordedSlugs.includes(s));
-  const registry = Object.values(TASKS).find((t) => path49.resolve(t.set) === path49.resolve(setDir));
+  const registry = Object.values(TASKS).find((t) => path50.resolve(t.set) === path50.resolve(setDir));
   const authored = (() => {
     if (registry !== void 0) return void 0;
     try {
@@ -16629,19 +16965,19 @@ function verdictCaveatsFor(input) {
 async function runVerify(opts) {
   const callerCwd = process.env["INIT_CWD"] ?? process.cwd();
   let recordingSetDrift;
-  const setOverride = opts.set !== void 0 ? path49.resolve(callerCwd, opts.set) : void 0;
-  opts = { ...opts, bundleDir: path49.resolve(callerCwd, opts.bundleDir), ...setOverride !== void 0 ? { set: setOverride } : {} };
-  if (!existsSync39(opts.bundleDir)) {
+  const setOverride = opts.set !== void 0 ? path50.resolve(callerCwd, opts.set) : void 0;
+  opts = { ...opts, bundleDir: path50.resolve(callerCwd, opts.bundleDir), ...setOverride !== void 0 ? { set: setOverride } : {} };
+  if (!existsSync40(opts.bundleDir)) {
     fail(opts, ExitCode.InputValidation, {
       error: `bundle directory not found: ${opts.bundleDir}`,
       code: "bundle-missing",
       remediation: "Point at a generated bundle directory (containing component.json, the entry module, and styles.css)."
     });
   }
-  const manifestPath2 = path49.join(opts.bundleDir, "component.json");
+  const manifestPath2 = path50.join(opts.bundleDir, "component.json");
   let manifest;
-  if (existsSync39(manifestPath2)) {
-    const { manifest: parsed, issues } = readBundleManifest(readFileSync35(manifestPath2, "utf8"));
+  if (existsSync40(manifestPath2)) {
+    const { manifest: parsed, issues } = readBundleManifest(readFileSync36(manifestPath2, "utf8"));
     if (issues.length > 0) {
       fail(opts, ExitCode.InputValidation, {
         error: `bundle manifest rejected at ingest: ${issues.map((i) => i.message).join("; ")}`,
@@ -16672,21 +17008,21 @@ async function runVerify(opts) {
     task = registry;
   } else if (manifest !== void 0) {
     const resolveSetDir = (p) => {
-      if (path49.isAbsolute(p)) return p;
-      const fromRepo = path49.resolve(REPO_ROOT, p);
-      if (existsSync39(fromRepo)) return fromRepo;
-      return path49.resolve(callerCwd, p);
+      if (path50.isAbsolute(p)) return p;
+      const fromRepo = path50.resolve(REPO_ROOT, p);
+      if (existsSync40(fromRepo)) return fromRepo;
+      return path50.resolve(callerCwd, p);
     };
     const setDir = opts.set ?? resolveSetDir(manifest.provenance.recordingSet.path);
-    if (!existsSync39(path49.join(setDir, "recording-set.json")) && !Object.values(TASKS).some((t) => path49.resolve(t.set) === path49.resolve(setDir))) {
+    if (!existsSync40(path50.join(setDir, "recording-set.json")) && !Object.values(TASKS).some((t) => path50.resolve(t.set) === path50.resolve(setDir))) {
       fail(opts, ExitCode.RecordingIncomplete, {
         error: `recording set not found or unmanifested: ${setDir}`,
         code: "recording-set-missing",
         remediation: "Pass --set <dir> pointing at the recording set this bundle was generated from."
       });
     }
-    const registry = Object.values(TASKS).find((t) => path49.resolve(t.set) === path49.resolve(setDir));
-    if (registry !== void 0 && !existsSync39(path49.join(setDir, "recording-set.json"))) {
+    const registry = Object.values(TASKS).find((t) => path50.resolve(t.set) === path50.resolve(setDir));
+    if (registry !== void 0 && !existsSync40(path50.join(setDir, "recording-set.json"))) {
       const recordedSlugs = registry.configs.map((c) => c.rep);
       const adapterSlugs = Object.keys(manifest.propAdapter);
       unmapped = recordedSlugs.filter((s) => !adapterSlugs.includes(s));
@@ -16718,9 +17054,9 @@ async function runVerify(opts) {
       recordingSetDrift = { stamped: manifest.provenance.recordingSet.hash, current: hash };
     }
     for (const name of [manifest.entry, "styles.css", "tokens.css"]) {
-      const p = path49.join(opts.bundleDir, name);
-      if (!existsSync39(p)) continue;
-      const issues = checkBundleSourceFile(name, new Uint8Array(readFileSync35(p)));
+      const p = path50.join(opts.bundleDir, name);
+      if (!existsSync40(p)) continue;
+      const issues = checkBundleSourceFile(name, new Uint8Array(readFileSync36(p)));
       if (issues.length > 0) {
         fail(opts, ExitCode.InputValidation, {
           error: `bundle source rejected at ingest: ${issues.map((i) => i.message).join("; ")}`,
@@ -16768,7 +17104,7 @@ async function runVerify(opts) {
     });
   }
   const bar = BARS2[opts.bar];
-  const evidenceDir = path49.join(opts.bundleDir, "verify-evidence");
+  const evidenceDir = path50.join(opts.bundleDir, "verify-evidence");
   rmSync7(evidenceDir, { recursive: true, force: true });
   const scores = await scoreBundleForTask(task, opts.bundleDir, bar, { evidenceDir, onProgress: emitProgress });
   const quality = await checkBundleQuality(
@@ -16786,7 +17122,7 @@ async function runVerify(opts) {
     // ASKED, never "follows every convention".
     loadCodebaseProfile(opts, opts.profile) ?? void 0
   );
-  const bundleCss = ["tokens.css", "styles.css"].map((f) => path49.join(opts.bundleDir, f)).filter((f) => existsSync39(f)).map((f) => readFileSync35(f, "utf8")).join("\n");
+  const bundleCss = ["tokens.css", "styles.css"].map((f) => path50.join(opts.bundleDir, f)).filter((f) => existsSync40(f)).map((f) => readFileSync36(f, "utf8")).join("\n");
   const occlusion = await checkSiblingOcclusion(task, opts.bundleDir, bundleCss, { ...authorityConfigs !== void 0 ? { authority: authorityConfigs } : {} });
   const parity = await checkHoverParity(task, opts.bundleDir, authorityConfigs ?? task.configs, {
     ...opts.hoverTimeoutMs !== void 0 ? { hoverBudgetMs: opts.hoverTimeoutMs } : {},
@@ -16807,10 +17143,10 @@ async function runVerify(opts) {
     warn(opts, `compositions extension REJECTED (${crossComposition.malformed}) \u2014 the cross-bundle backstop did NOT run over it; repair the manifest entry and re-verify. This is an instrument failure, not a clean bill.`);
   }
   const verifyCallerCwd = process.env["INIT_CWD"] ?? process.cwd();
-  const verifyPins = crossComposition.rows.length > 0 ? composedPins(task.set, [opts.library !== void 0 ? path49.resolve(verifyCallerCwd, opts.library) : verifyCallerCwd]) : { pins: [], issues: [] };
+  const verifyPins = crossComposition.rows.length > 0 ? composedPins(task.set, [opts.library !== void 0 ? path50.resolve(verifyCallerCwd, opts.library) : verifyCallerCwd]) : { pins: [], issues: [] };
   const staticComposedChecks = composedChecks(opts.bundleDir, task.entry, verifyPins.pins);
   const renderExpectations = verifyPins.pins.map((pin) => ({
-    modulePath: path49.join(composedModuleDir(pin.partnerName), pin.entryComponent),
+    modulePath: path50.join(composedModuleDir(pin.partnerName), pin.entryComponent),
     component: pin.entryComponent,
     stampName: `${pin.pairKey}:${pin.entryComponent}`,
     hostReps: [...new Set(pin.instances.map((i) => i.hostRep))],
@@ -16869,6 +17205,59 @@ async function runVerify(opts) {
   })();
   const compositionBlock = compositionReport({ availability, structural, crops, regions: regionsOut, composedPairs: composedPairs.size });
   const scoredFiles = digestScoredFiles(opts.bundleDir, manifest !== void 0 ? manifest.entry : task.entry);
+  const verdictWord = ok ? "verified" : "verification-failed";
+  const verdictCaveats = verdictCaveatsFor({
+    latticeBlock,
+    operability: coverage.operability,
+    compositionUnavailable: "unavailable" in compositionBlock,
+    fontsSubstituted: substitutedFamilies.length > 0,
+    pixelOnlyInteractionPoses: unmappedInteractionEvidence.length,
+    hoverBudgetNondefault: opts.hoverTimeoutMs !== void 0 && opts.hoverTimeoutMs !== DEFAULT_HOVER_BUDGET_MS
+  });
+  const composeScan = (() => {
+    if (!ok || opts.bar === "cert" && substitutedFamilies.length > 0) return void 0;
+    try {
+      const setAbs = path50.resolve(task.set);
+      let scannedRoots;
+      let skipped;
+      if (opts.library !== void 0) {
+        scannedRoots = [path50.resolve(opts.library)];
+      } else {
+        const parent = path50.dirname(setAbs);
+        let entries = 0;
+        try {
+          entries = readdirSync16(parent).length;
+        } catch {
+        }
+        if (entries > IMPLICIT_PARENT_SCAN_MAX_ENTRIES) {
+          skipped = { dir: parent, entries };
+          scannedRoots = [];
+        } else {
+          scannedRoots = [parent];
+        }
+      }
+      const scan = scannedRoots.length > 0 ? partnerOpportunities(setAbs, scannedRoots) : { opportunities: [], hostsWithUnreadableDecisions: [] };
+      return { scannedRoots, ...skipped !== void 0 ? { skipped } : {}, ...scan };
+    } catch (err) {
+      return { scannedRoots: [], opportunities: [], hostsWithUnreadableDecisions: [], error: err instanceof Error ? err.message.split("\n")[0] ?? String(err) : String(err) };
+    }
+  })();
+  const green = ok && !(opts.bar === "cert" && substitutedFamilies.length > 0);
+  const sheetOutcome = (() => {
+    if (!green) return { built: false };
+    try {
+      const built = buildInspectSheet({
+        bundleDir: opts.bundleDir,
+        setDir: task.set,
+        title: manifest !== void 0 ? manifest.name : path50.basename(opts.bundleDir),
+        repCandidates: statuses.map((s) => s.rep),
+        report: { configs: statuses, behaviors, verdict: verdictWord, targetBar: opts.bar, verdictCaveats }
+      });
+      return { built: true, crops: built.crops };
+    } catch (error) {
+      return { built: false, error: error instanceof Error ? error.message.split("\n")[0] ?? String(error) : String(error) };
+    }
+  })();
   const report = {
     bundle: opts.bundleDir,
     scoredFiles,
@@ -16962,7 +17351,7 @@ async function runVerify(opts) {
     behaviors,
     evidence: { dir: evidenceDir, ...evidenceArtifacts(evidenceDir, statuses.map((s) => s.rep)) },
     composition: compositionBlock,
-    verdict: ok ? "verified" : "verification-failed",
+    verdict: verdictWord,
     // Run-23 R5: the one-word verdict printed beside "coverage
     // denominator unknown" and "operability unverified" read, to a
     // JSON consumer who stops at `verdict`, as fully verified — the
@@ -16971,14 +17360,7 @@ async function runVerify(opts) {
     // consumer cannot claim it was never offered. Exit codes are
     // unchanged, deliberately: each claim in the report is true; the
     // caveats say which questions were never answered.
-    verdictCaveats: verdictCaveatsFor({
-      latticeBlock,
-      operability: coverage.operability,
-      compositionUnavailable: "unavailable" in compositionBlock,
-      fontsSubstituted: substitutedFamilies.length > 0,
-      pixelOnlyInteractionPoses: unmappedInteractionEvidence.length,
-      hoverBudgetNondefault: opts.hoverTimeoutMs !== void 0 && opts.hoverTimeoutMs !== DEFAULT_HOVER_BUDGET_MS
-    }),
+    verdictCaveats,
     // Machine-readable cause (adversarial review): a cert-bar failure
     // with zero pixel/behavior/composition failures was only
     // explainable from stderr prose.
@@ -16991,7 +17373,25 @@ async function runVerify(opts) {
     motion: motionDisclosure(opts.bundleDir, task.set),
     ...recordingSetDrift !== void 0 ? { recordingSetDrift } : {},
     ...substitutedFamilies.length > 0 ? { substitutedFamilies } : {},
-    eyeCheck: eyeCheck(opts.bundleDir)
+    eyeCheck: eyeCheck(opts.bundleDir, sheetOutcome),
+    // Field handoff 2026-08-26 (problem 2): a verified component's
+    // value lands when it is LIVE — the terminal step of a green run
+    // is publishing, and the report says so in the machine channel
+    // too. Verify itself stays account-less and network-less
+    // (ruler-authority invariant 3): this is a pointer, never a call.
+    // Stdout-only guidance — verifyReportForTransport strips it, like
+    // eyeCheck, before the report is persisted or uploaded.
+    ...green ? {
+      next: {
+        action: "publish",
+        command: tendrilCommand(`publish "${opts.bundleDir}"`),
+        mcpTools: ["tendril_publish", "tendril_publish_wait (repeat while it returns approval-pending)"],
+        note: "MCP hosts: use the tools, never the shell command \u2014 the split phases keep the approve link in hand while the wait polls. A FIRST publish waits for the user's Approve in their signed-in browser (the CLI cannot approve); a re-publish of an already-published component completes in one call"
+      }
+    } : {},
+    // Stdout-only, like `next` — verifyReportForTransport strips it
+    // (absolute host paths must never travel to a published page).
+    ...composeScan !== void 0 ? { composeOpportunities: composeScan } : {}
   };
   emitData(opts, report, () => {
     for (const s of statuses) {
@@ -17123,7 +17523,7 @@ ${certified}/${statuses.length} certified \xB7 ${report.coverage.pass}/${statuse
     }
     process.stdout.write(`environment: chrome=${report.environment.chromeVersion ?? report.environment.chrome} fonts=${report.environment.fontsManifestSha256 ?? "UNRESOLVED"}
 `);
-    const shippedFonts = requiredFontsManifest(cssFontFamilies(["styles.css", "tokens.css"].map((f) => path49.join(opts.bundleDir, f)).filter((f) => existsSync39(f)).map((f) => readFileSync35(f, "utf8")).join("\n")));
+    const shippedFonts = requiredFontsManifest(cssFontFamilies(["styles.css", "tokens.css"].map((f) => path50.join(opts.bundleDir, f)).filter((f) => existsSync40(f)).map((f) => readFileSync36(f, "utf8")).join("\n")));
     if (shippedFonts.length > 0 && substitutedFamilies.length === 0) {
       process.stdout.write(`fonts: scored with Tendril-cache faces \u2014 a consuming app must provision the same families (the bundle ships fonts.css when faces are shippable; sha-pinned list in component.json requiredFonts)
 `);
@@ -17136,8 +17536,58 @@ ${certified}/${statuses.length} certified \xB7 ${report.coverage.pass}/${statuse
     }
     process.stdout.write(`evidence: ${evidenceDir} (render/ref/diff per config)
 `);
-    process.stdout.write(`eye check: ${report.eyeCheck.command} \u2014 magnified recorded-vs-rendered crops of every small node; scores cannot see shape (re-run after every verify)
+    if (report.eyeCheck.sheetBuilt === true) {
+      process.stdout.write(`eye check: sheet WRITTEN at ${report.eyeCheck.sheetPath} (${report.eyeCheck.sheetCrops ?? 0} detail crop pair(s)) \u2014 magnified recorded-vs-rendered crops of every small node; scores cannot see shape. Open it; ${report.eyeCheck.command} rebuilds it.
+`);
+    } else {
+      const buildNote = report.eyeCheck.sheetBuildError !== void 0 ? ` (this run tried to build it and could not: ${report.eyeCheck.sheetBuildError})` : "";
+      process.stdout.write(`eye check: ${report.eyeCheck.command} \u2014 magnified recorded-vs-rendered crops of every small node; scores cannot see shape (re-run after every verify)${buildNote}
+`);
+    }
+    if (green) {
+      process.stdout.write(
+        `
+READY     this component is verified \u2014 the run is not finished until it is LIVE: ${tendrilCommand(`publish "${opts.bundleDir}"`)} publishes it (a FIRST publish waits for the user's Approve in their signed-in browser \u2014 the CLI cannot approve; a re-publish completes in one call)
+`
+      );
+    }
+    if (composeScan !== void 0) {
+      const OPP_SHOWN = 5;
+      if (composeScan.error !== void 0) {
+        process.stdout.write(`COMPOSE   discovery UNAVAILABLE (${composeScan.error}) \u2014 whether other recordings embed this component is UNKNOWN, not "no"
 `);
+      }
+      for (const o of composeScan.opportunities.slice(0, OPP_SHOWN)) {
+        const hostQ = quoteArg(o.hostSet);
+        if (o.kind === "confirmable") {
+          process.stdout.write(
+            `COMPOSE   ${o.hostDisplayName} [${o.hostSet}] embeds this component in ${o.instances} instance(s) across ${o.hostReps.length} pose(s) \u2014 id-backed and confirmable. A human decides it, in their terminal, against the HOST set: ${tendrilCommand(`compose --set ${hostQ}`)} (decline instead with ${tendrilCommand(`compose --set ${hostQ} --decline ${o.pairKey ?? ""}`)}). After confirming, regenerate the HOST bundle (an agent run: brief \u2192 generate \u2192 score \u2192 verify, with --library pointing at the workspace holding this bundle) \u2014 composition never retrofits an existing bundle.
+`
+          );
+        } else if (o.kind === "ambiguous") {
+          process.stdout.write(
+            `COMPOSE   ${o.hostDisplayName} [${o.hostSet}]: id evidence reaches this component AMBIGUOUSLY (${o.instances} instance(s)) \u2014 the confirm channel cannot take it yet; a human looks via ${tendrilCommand("compose --list")}
+`
+          );
+        } else {
+          process.stdout.write(`COMPOSE   ${o.hostDisplayName} [${o.hostSet}]: name-only match (${o.instances} instance(s)) \u2014 identity unproven, not confirmable. ${o.disclosures.find((d) => d.includes("re-record")) ?? "Id evidence is needed for a pairing."}
+`);
+        }
+      }
+      if (composeScan.opportunities.length > OPP_SHOWN) {
+        process.stdout.write(`COMPOSE   \u2026 and ${composeScan.opportunities.length - OPP_SHOWN} more \u2014 ${tendrilCommand("compose --list")} shows the full report
+`);
+      }
+      for (const u of composeScan.hostsWithUnreadableDecisions) {
+        process.stdout.write(`COMPOSE   NOTE: ${u.hostSet} has ${u.unreadable} unreadable standing composition entr${u.unreadable === 1 ? "y" : "ies"} \u2014 decisions may exist that this scan cannot see
+`);
+      }
+      process.stdout.write(
+        composeScan.skipped !== void 0 ? `COMPOSE   scanned: (none) \u2014 the set's parent (${composeScan.skipped.dir}) holds ${composeScan.skipped.entries} entries and was not scanned as a recordings library; pass --library <dir> to scan one deliberately
+` : `COMPOSE   scanned: ${composeScan.scannedRoots.join(", ")} \u2014 recording sets elsewhere are NOT seen; pass --library <dir> to scan another workspace
+`
+      );
+    }
   });
   if (opts.bar === "cert" && substitutedFamilies.length > 0) {
     const names = substitutedFamilies.map((f) => `"${f}"`).join(", ");
@@ -17178,7 +17628,7 @@ ${certified}/${statuses.length} certified \xB7 ${report.coverage.pass}/${statuse
   persistReport(opts, report, evidenceDir);
 }
 function persistReport(opts, report, evidenceDir) {
-  if (!existsSync39(evidenceDir)) return;
+  if (!existsSync40(evidenceDir)) return;
   const rulerExit = process.exitCode === void 0 ? 0 : Number(process.exitCode);
   const withExit = {
     ...report,
@@ -17186,9 +17636,9 @@ function persistReport(opts, report, evidenceDir) {
     ...rulerExit !== 0 ? { rulerRefusal: EXIT_REFUSALS[rulerExit] ?? `ruler exited ${rulerExit}` } : {}
   };
   try {
-    writeFileSync17(
-      path49.join(evidenceDir, VERIFY_REPORT_FILENAME),
-      `${JSON.stringify(verifyReportForTransport(withExit, path49.basename(opts.bundleDir)), null, 2)}
+    writeFileSync18(
+      path50.join(evidenceDir, VERIFY_REPORT_FILENAME),
+      `${JSON.stringify(verifyReportForTransport(withExit, path50.basename(opts.bundleDir)), null, 2)}
 `
     );
   } catch (e) {
@@ -17206,6 +17656,8 @@ var init_verify = __esm({
     init_src5();
     init_environment();
     init_font_guidance();
+    init_compose2();
+    init_inspect();
     init_invocation();
     init_output();
     init_profile_input();
@@ -17238,20 +17690,31 @@ __export(engine_exports, {
   runEngineBrief: () => runEngineBrief,
   runEngineScore: () => runEngineScore
 });
-import { appendFileSync, existsSync as existsSync40, mkdirSync as mkdirSync12, readFileSync as readFileSync36, writeFileSync as writeFileSync18 } from "node:fs";
-import path50 from "node:path";
+import { appendFileSync, existsSync as existsSync41, mkdirSync as mkdirSync12, readFileSync as readFileSync37, writeFileSync as writeFileSync19 } from "node:fs";
+import path51 from "node:path";
 function resolveEngineTask(opts, callerCwd) {
-  const asPath = path50.resolve(callerCwd, opts.taskOrSet);
-  const isSet = existsSync40(path50.join(asPath, "recording-set.json"));
+  const asPath = path51.resolve(callerCwd, opts.taskOrSet);
+  const isSet = existsSync41(path51.join(asPath, "recording-set.json"));
   const registry = TASKS[opts.taskOrSet];
   if (registry !== void 0 && !isSet) return { task: registry, name: opts.taskOrSet, ref: opts.taskOrSet, disclosures: [], interactionEvidence: void 0 };
   if (isSet) {
+    const manifest = loadManifest(asPath);
+    const missing = manifest.reps.filter(
+      (r) => !repEnvelopeExists(asPath, r.slug, "metadata") || !existsSync41(path51.join(asPath, r.slug, "get_design_context.json"))
+    );
+    if (missing.length > 0) {
+      fail(opts, ExitCode.RecordingIncomplete, {
+        error: `recording set ${asPath} is missing envelopes for ${missing.length} rep(s): ${missing.slice(0, 3).map((r) => r.slug).join(", ")}${missing.length > 3 ? ", \u2026" : ""}`,
+        code: "recording-incomplete",
+        remediation: `Resume the recording (\`${tendrilCommand(`record next --set ${asPath}`)}\`) until \`${tendrilCommand(`record status --set ${asPath}`)}\` reports the set complete, then re-run this.`
+      });
+    }
     try {
       const authored = authorTaskFromSet(asPath);
       for (const d of authored.disclosures) warn(opts, d);
       return {
         task: authored.task,
-        name: path50.basename(asPath),
+        name: path51.basename(asPath),
         ref: asPath,
         disclosures: authored.disclosures,
         interactionEvidence: authored.api.interactionEvidence,
@@ -17280,9 +17743,9 @@ function runEngineBrief(opts) {
   const { task, name, ref, disclosures } = resolveEngineTask(opts, callerCwd);
   void reportRunPresence(name, "implementing");
   const bar = BARS3[opts.bar];
-  if (existsSync40(path50.join(task.set, "recording-set.json"))) {
+  if (existsSync41(path51.join(task.set, "recording-set.json"))) {
     try {
-      const { open, skippedParent } = compositionPairsFor(path50.resolve(task.set), [opts.library !== void 0 ? path50.resolve(callerCwd, opts.library) : callerCwd]);
+      const { open, proposals, skippedParent } = compositionPairsFor(path51.resolve(task.set), [opts.library !== void 0 ? path51.resolve(callerCwd, opts.library) : callerCwd]);
       if (skippedParent !== void 0) {
         disclosures.push(
           `COMPOSITION DISCOVERY PARTIAL: the set's parent directory (${skippedParent.dir}) holds ${String(skippedParent.entries)} entries and was not scanned as a recordings library \u2014 sibling sets there are invisible to pairing. Pass --library <dir> to scan a specific library deliberately.`
@@ -17291,7 +17754,12 @@ function runEngineBrief(opts) {
       if (open.length > 0) {
         const componentNames = [...new Set(open.map((p) => p.displayName))];
         disclosures.push(
-          `COMPOSITION PAIRS UNDECIDED: this recording references ${componentNames.length} other recorded component(s) (${open.map((p) => `${p.displayName} [pair-key ${p.key}]: ${p.instances.length} instance(s)`).join("; ")}) and no human has decided the pairing. This brief treats the component as SELF-CONTAINED \u2014 you will re-implement the partner's pixels locally. If composition is wanted: generate the partner bundle first, have a human run \`${tendrilCommand(`compose --set ${path50.resolve(task.set)}`)}\` in their terminal, and re-emit this brief. Proceeding as-is is valid; it just is not composition.`
+          `COMPOSITION PAIRS UNDECIDED: this recording references ${componentNames.length} other recorded component(s) (${open.map((p) => `${p.displayName} [pair-key ${p.key}]: ${p.instances.length} instance(s)`).join("; ")}) and no human has decided the pairing. This brief treats the component as SELF-CONTAINED \u2014 you will re-implement the partner's pixels locally. If composition is wanted: generate the partner bundle first, have a human run \`${tendrilCommand(`compose --set ${path51.resolve(task.set)}`)}\` in their terminal, and re-emit this brief. Proceeding as-is is valid; it just is not composition.`
+        );
+      }
+      if (proposals.length > 0) {
+        disclosures.push(
+          `COMPOSITION NAME-ONLY: instance names match ${proposals.length} recorded component(s) (${proposals.map((p) => `${p.displayName}: ${p.instances} instance(s)`).join("; ")}) but identity is UNPROVEN \u2014 name evidence never auto-joins, so these regions are implemented locally. ${proposals.flatMap((p) => p.disclosures).find((d) => d.includes("re-record")) ?? "Record id evidence to make a pairing confirmable, or proceed self-contained."}`
         );
       }
     } catch (err) {
@@ -17308,9 +17776,9 @@ ${disclosures.map((d) => `- ${d}`).join("\n")}` : "";
   const brief = buildBrief(task.systemApi, bar, { colorScheme: recordingIsDark(task) ? "dark" : "light" }) + disclosureBlock + motionBriefSection(task.set) + conventions;
   const segments = buildSegments(task, "files");
   let notRecorded;
-  const manifestPath2 = path50.join(task.set, "recording-set.json");
-  if (existsSync40(manifestPath2)) {
-    notRecorded = JSON.parse(readFileSync36(manifestPath2, "utf8")).notRecorded;
+  const manifestPath2 = path51.join(task.set, "recording-set.json");
+  if (existsSync41(manifestPath2)) {
+    notRecorded = JSON.parse(readFileSync37(manifestPath2, "utf8")).notRecorded;
   }
   const unverified = notRecorded !== void 0 && notRecorded !== "" ? `
 
@@ -17318,7 +17786,7 @@ ${disclosures.map((d) => `- ${d}`).join("\n")}` : "";
 DO NOT INVENT PIXELS FOR THESE POSES. Implement them ONLY as the composition of recorded per-axis truth (the custom-property composition rule: one paint axis sets variables, the other consumes) and list every such pose in your report as UNRECORDED-COMPOSED. Recording them is the real fix: re-plan the set (full matrix is the default) and record the missing poses.
 ${notRecorded}` : "";
   let fontProvisioning;
-  if (existsSync40(manifestPath2)) {
+  if (existsSync41(manifestPath2)) {
     const missingFams = unprovisionedFamilies(task.set);
     const unprovided = unprovisionedFaces(task.set);
     const weightOnly = missingFams.length === 0;
@@ -17340,7 +17808,7 @@ ${notRecorded}` : "";
       };
     }
   }
-  const pinsResult = composedPins(task.set, [opts.library !== void 0 ? path50.resolve(callerCwd, opts.library) : callerCwd]);
+  const pinsResult = composedPins(task.set, [opts.library !== void 0 ? path51.resolve(callerCwd, opts.library) : callerCwd]);
   const jsxProp = ([k, v]) => typeof v === "string" ? `${k}=${JSON.stringify(v)}` : `${k}={${JSON.stringify(v)}}`;
   const composedBlock = pinsResult.pins.length === 0 && pinsResult.issues.length === 0 ? "" : (pinsResult.pins.length > 0 ? `
 
@@ -17376,10 +17844,10 @@ ${pinsResult.issues.map((i) => `- ${i}`).join("\n")}` : "");
 
 === TASK PAYLOAD (recorded truth, verbatim) ===
 ${segments}`;
-  const payloadFile = path50.resolve(callerCwd, opts.out ?? `tendril-out/${name}-brief.md`);
-  const candidateDirSuggestion = path50.resolve(callerCwd, `tendril-out/${name}-candidate`);
-  mkdirSync12(path50.dirname(payloadFile), { recursive: true });
-  writeFileSync18(payloadFile, payload);
+  const payloadFile = path51.resolve(callerCwd, opts.out ?? `tendril-out/${name}-brief.md`);
+  const candidateDirSuggestion = path51.resolve(callerCwd, `tendril-out/${name}-candidate`);
+  mkdirSync12(path51.dirname(payloadFile), { recursive: true });
+  writeFileSync19(payloadFile, payload);
   emitData(
     opts,
     {
@@ -17425,7 +17893,7 @@ ${segments}`;
         // command must search the same bundle roots the pins came
         // from, or the oracle and the brief describe different worlds.
         `Run \`${tendrilCommand(
-          `engine score ${quoteArg(ref)} ${quoteArg(candidateDirSuggestion)} --bar ${opts.bar} --model ${opts.model ?? "<declared-model>"}${opts.library !== void 0 ? ` --library ${quoteArg(path50.resolve(callerCwd, opts.library))}` : ""} --json`
+          `engine score ${quoteArg(ref)} ${quoteArg(candidateDirSuggestion)} --bar ${opts.bar} --model ${opts.model ?? "<declared-model>"}${opts.library !== void 0 ? ` --library ${quoteArg(path51.resolve(callerCwd, opts.library))}` : ""} --json`
         )}\` \u2014 the CLI is the sole judge, and it refuses to score an undeclared model. If you wrote the bundle elsewhere, pass that directory instead.`,
         "Apply the returned feedback and re-score. Stop when all checks pass. Two consecutive non-improving scores mean INSPECT the verify-evidence diffs before deciding \u2014 stop only when inspection yields no fix hypothesis (a measured run was byte-identical twice, then went 27/27 after reading the diffs).",
         "Never edit recording sets; never claim scores yourself \u2014 only the score command's output counts."
@@ -17440,8 +17908,8 @@ ${segments}`;
   );
 }
 function appendScoreHistory(candidateDir, entry) {
-  const file = path50.join(candidateDir, "score-history.jsonl");
-  const starts = existsSync40(file) ? readFileSync36(file, "utf8").split("\n").filter((l) => l.includes('"event":"round-start"')).length : 0;
+  const file = path51.join(candidateDir, "score-history.jsonl");
+  const starts = existsSync41(file) ? readFileSync37(file, "utf8").split("\n").filter((l) => l.includes('"event":"round-start"')).length : 0;
   const round = entry.event === "round-start" ? starts + 1 : Math.max(1, starts);
   appendFileSync(file, `${JSON.stringify({ at: (/* @__PURE__ */ new Date()).toISOString(), round, ...entry })}
 `);
@@ -17449,10 +17917,10 @@ function appendScoreHistory(candidateDir, entry) {
 async function runEngineScore(opts) {
   requireEntitlement(opts);
   const callerCwd = process.env["INIT_CWD"] ?? process.cwd();
-  const candidateDir = path50.resolve(callerCwd, opts.candidateDir);
+  const candidateDir = path51.resolve(callerCwd, opts.candidateDir);
   const { task, name, apiPin, interactionEvidence, unmappedInteractionEvidence: interactionEvidenceUnmapped, satisfiabilityDemoted, expertContract } = resolveEngineTask(opts, callerCwd);
   void reportRunPresence(name, "implementing");
-  if (!existsSync40(candidateDir)) {
+  if (!existsSync41(candidateDir)) {
     fail(opts, ExitCode.InputValidation, {
       error: `candidate directory not found: ${candidateDir}`,
       code: "candidate-missing",
@@ -17477,10 +17945,10 @@ async function runEngineScore(opts) {
   for (const g of missingWeights(task.set)) {
     warn(opts, `font weights (advisory): the recording implies weights ${g.declared.join(", ")} for "${g.family}" \u2014 cache provides ${g.provided.join(", ")}; nearest-weight rendering may shift stroke density (certification stays family-gated; implied weights can leak across families)`);
   }
-  if (opts.rebind !== true && existsSync40(path50.join(candidateDir, "component.json"))) {
+  if (opts.rebind !== true && existsSync41(path51.join(candidateDir, "component.json"))) {
     const prior = (() => {
       try {
-        const read = readBundleManifest(readFileSync36(path50.join(candidateDir, "component.json"), "utf8"));
+        const read = readBundleManifest(readFileSync37(path51.join(candidateDir, "component.json"), "utf8"));
         return read.manifest === void 0 ? { unreadable: true } : { hash: read.manifest.provenance.recordingSet.hash, path: read.manifest.provenance.recordingSet.path };
       } catch {
         return { unreadable: true };
@@ -17502,13 +17970,13 @@ async function runEngineScore(opts) {
     }
   }
   const bar = BARS3[opts.bar];
-  const evidenceDir = path50.join(candidateDir, "verify-evidence");
+  const evidenceDir = path51.join(candidateDir, "verify-evidence");
   const scores = await scoreBundleForTask(task, candidateDir, bar, { evidenceDir, onProgress: emitProgress });
   const hoverOpts = opts.hoverTimeoutMs !== void 0 ? { hoverBudgetMs: opts.hoverTimeoutMs } : {};
   const parity = await checkHoverParity(task, candidateDir, task.configs, { ...hoverOpts, failureShotDir: evidenceDir });
   const occlusionRows = await checkSiblingOcclusion(task, candidateDir, candidateCss(candidateDir), { authority: task.configs });
   const occlusionFailures = occlusionRows.filter((o) => !o.pass);
-  const scorePins = composedPins(task.set, [opts.library !== void 0 ? path50.resolve(callerCwd, opts.library) : callerCwd]);
+  const scorePins = composedPins(task.set, [opts.library !== void 0 ? path51.resolve(callerCwd, opts.library) : callerCwd]);
   const composition = composedChecks(candidateDir, task.entry, scorePins.pins);
   const behaviors = [...await checkBehaviors(task, candidateDir, hoverOpts), ...parity, ...composition];
   const parityCoverage = parity.length > 0 ? `${parity.filter((p) => p.pass).length}/${parity.length} hover-forced configs` : "not applicable (no hover-forced configs in this set)";
@@ -17646,7 +18114,18 @@ ${scorePins.issues.map((i) => `- ${i}`).join("\n")}` : "";
       // bundles verify then FAILED on the interaction-evidence gate —
       // the oracle must say what verify will say, including this.
       ...evidenceUnverified ? { interactionEvidenceUnverified: true, verifyWillFail: "interaction-evidence \u2014 the recording proves interactive poses none of the authored behaviors cover; not fixable from component code; REPORT it, do not iterate on it" } : {},
-      certification: { certified: certifiedReps.length, total: scores.length, bar: certBar, note: "tierOf on exact values + parity and absent-ink demotion; verify's A1.4 structural/crop checks can demote further" }
+      certification: { certified: certifiedReps.length, total: scores.length, bar: certBar, note: "tierOf on exact values + parity and absent-ink demotion; verify's A1.4 structural/crop checks can demote further" },
+      // Field handoff 2026-08-26 (problem 2): the loop's green is not
+      // the pipeline's end — a run that stops at allPass leaves the
+      // component reachable only on local disk. The oracle names the
+      // remaining steps so no surface has to remember them for it.
+      ...allPass ? {
+        next: {
+          action: "verify",
+          command: tendrilCommand(`verify "${opts.candidateDir}" --bar ${certifiedReps.length === scores.length ? "cert" : "pass"}`),
+          note: "allPass ends the LOOP, not the run: recompute with tendril_verify (the ruler's report + evidence), and a green verify's terminal step is publishing \u2014 the component is done when it is live, not when it scores"
+        }
+      } : {}
     },
     () => {
       for (const s of scores) process.stdout.write(`${s.pass ? certifiedSet.has(s.rep) ? "CERT" : "PASS" : "FAIL"} ${s.rep}: sim=${s.similarity} ink=${s.inkRecall}${s.error !== void 0 ? ` [${s.error}]` : ""}
@@ -17702,6 +18181,7 @@ var init_engine2 = __esm({
   "packages/cli/src/commands/engine.ts"() {
     "use strict";
     init_src3();
+    init_src();
     init_src7();
     init_src4();
     init_environment();
@@ -17727,11 +18207,11 @@ var codeconnect_exports = {};
 __export(codeconnect_exports, {
   runCodeConnect: () => runCodeConnect
 });
-import { existsSync as existsSync41, readFileSync as readFileSync37, writeFileSync as writeFileSync19 } from "node:fs";
-import path51 from "node:path";
+import { existsSync as existsSync42, readFileSync as readFileSync38, writeFileSync as writeFileSync20 } from "node:fs";
+import path52 from "node:path";
 function runCodeConnect(opts) {
   const callerCwd = process.env["INIT_CWD"] ?? process.cwd();
-  const bundleDir = path51.resolve(callerCwd, opts.bundleDir);
+  const bundleDir = path52.resolve(callerCwd, opts.bundleDir);
   let url;
   try {
     url = new URL(opts.figmaUrl);
@@ -17747,7 +18227,7 @@ function runCodeConnect(opts) {
   }
   let manifest;
   try {
-    const read = readBundleManifest(readFileSync37(path51.join(bundleDir, "component.json"), "utf8"));
+    const read = readBundleManifest(readFileSync38(path52.join(bundleDir, "component.json"), "utf8"));
     if (read.manifest === void 0) throw new Error(read.issues.map((i) => i.message).join("; ") || "no component.json");
     manifest = read.manifest;
   } catch (err) {
@@ -17757,8 +18237,8 @@ function runCodeConnect(opts) {
       remediation: "Point at a bundle produced by the Tendril pipeline (it carries component.json), and verify it first."
     });
   }
-  const setDir = path51.resolve(callerCwd, opts.set ?? manifest.provenance.recordingSet.path);
-  if (!existsSync41(path51.join(setDir, "recording-set.json"))) {
+  const setDir = path52.resolve(callerCwd, opts.set ?? manifest.provenance.recordingSet.path);
+  if (!existsSync42(path52.join(setDir, "recording-set.json"))) {
     fail(opts, ExitCode.InputValidation, {
       error: `recording set not found at ${setDir}`,
       code: "codeconnect-no-set",
@@ -17780,9 +18260,9 @@ function runCodeConnect(opts) {
   const recManifest = loadManifest(setDir);
   const poseNames = recManifest.latticeNames ?? recManifest.reps.map((r) => {
     const meta = resolveRepEnvelopePath(setDir, r.slug, "metadata");
-    if (!existsSync41(meta)) return void 0;
+    if (!existsSync42(meta)) return void 0;
     try {
-      return /name="([^"]*)"/.exec(envelopeTextContent(JSON.parse(readFileSync37(meta, "utf8"))))?.[1];
+      return /name="([^"]*)"/.exec(envelopeTextContent(JSON.parse(readFileSync38(meta, "utf8"))))?.[1];
     } catch {
       return void 0;
     }
@@ -17847,7 +18327,7 @@ function runCodeConnect(opts) {
     axisLines.push(`const ${varName} = instance.getEnum(${q(axis)}, { ${entries.join(", ")} })`);
     fragmentVars.push(varName);
   }
-  const entryRel = path51.relative(callerCwd, path51.join(bundleDir, manifest.entry));
+  const entryRel = path52.relative(callerCwd, path52.join(bundleDir, manifest.entry));
   const trust = manifest.trustStatement.split("\n")[0] ?? "";
   const lines = [
     `// url=${opts.figmaUrl}`,
@@ -17871,8 +18351,8 @@ function runCodeConnect(opts) {
     `}`,
     ``
   ].join("\n");
-  const outFile = path51.resolve(callerCwd, opts.out ?? path51.join(bundleDir, `${component}.figma.ts`));
-  writeFileSync19(outFile, lines);
+  const outFile = path52.resolve(callerCwd, opts.out ?? path52.join(bundleDir, `${component}.figma.ts`));
+  writeFileSync20(outFile, lines);
   emitData(
     opts,
     {
@@ -17912,17 +18392,17 @@ var init_codeconnect = __esm({
 
 // packages/mcp/src/server.ts
 import { createHash as createHash11 } from "node:crypto";
-import { existsSync as existsSync42, mkdtempSync as mkdtempSync3, readFileSync as readFileSync38, readdirSync as readdirSync16, writeFileSync as writeFileSync20 } from "node:fs";
+import { existsSync as existsSync43, mkdtempSync as mkdtempSync3, readFileSync as readFileSync39, readdirSync as readdirSync17, writeFileSync as writeFileSync21 } from "node:fs";
 import os8 from "node:os";
-import path52 from "node:path";
+import path53 from "node:path";
 import { fileURLToPath as fileURLToPath6 } from "node:url";
 import { z as z15 } from "zod";
 function sourceHash() {
-  const dir = path52.dirname(fileURLToPath6(import.meta.url));
+  const dir = path53.dirname(fileURLToPath6(import.meta.url));
   const h = createHash11("sha256");
-  for (const f of readdirSync16(dir).filter((n) => n.endsWith(".ts")).sort()) {
+  for (const f of readdirSync17(dir).filter((n) => n.endsWith(".ts")).sort()) {
     h.update(f);
-    h.update(readFileSync38(path52.join(dir, f)));
+    h.update(readFileSync39(path53.join(dir, f)));
   }
   return h.digest("hex").slice(0, 16);
 }
@@ -17930,10 +18410,10 @@ var REPO_ROOT3, CLI_BIN, BUNDLED_CLI, CLI_SPAWN, str, optStr, TOOLS, BOOT_HASH;
 var init_server = __esm({
   "packages/mcp/src/server.ts"() {
     "use strict";
-    REPO_ROOT3 = path52.resolve(path52.dirname(fileURLToPath6(import.meta.url)), "..", "..", "..");
-    CLI_BIN = path52.join(REPO_ROOT3, "packages", "cli", "src", "bin.ts");
-    BUNDLED_CLI = path52.join(path52.dirname(fileURLToPath6(import.meta.url)), "tendril.js");
-    CLI_SPAWN = existsSync42(BUNDLED_CLI) ? { cmd: process.execPath, prefix: [BUNDLED_CLI] } : { cmd: "npx", prefix: ["tsx", CLI_BIN] };
+    REPO_ROOT3 = path53.resolve(path53.dirname(fileURLToPath6(import.meta.url)), "..", "..", "..");
+    CLI_BIN = path53.join(REPO_ROOT3, "packages", "cli", "src", "bin.ts");
+    BUNDLED_CLI = path53.join(path53.dirname(fileURLToPath6(import.meta.url)), "tendril.js");
+    CLI_SPAWN = existsSync43(BUNDLED_CLI) ? { cmd: process.execPath, prefix: [BUNDLED_CLI] } : { cmd: "npx", prefix: ["tsx", CLI_BIN] };
     str = (d) => z15.string().describe(d);
     optStr = (d) => z15.string().optional().describe(d);
     TOOLS = [
@@ -17964,13 +18444,13 @@ var init_server = __esm({
           const single = i["metadata"];
           const parts = i["metadataParts"];
           if (single !== void 0 || parts !== void 0) {
-            const tmp = path52.join(mkdtempSync3(path52.join(os8.tmpdir(), "tendril-envelope-")), "response.txt");
+            const tmp = path53.join(mkdtempSync3(path53.join(os8.tmpdir(), "tendril-envelope-")), "response.txt");
             if (single !== void 0) {
-              writeFileSync20(tmp, single);
+              writeFileSync21(tmp, single);
               argvOut.push("--metadata-raw-file", tmp);
             } else {
               if (parts.length === 0) throw new Error("`metadataParts` must be a non-empty array of block texts");
-              writeFileSync20(tmp, JSON.stringify(parts));
+              writeFileSync21(tmp, JSON.stringify(parts));
               argvOut.push("--metadata-raw-parts-file", tmp);
             }
           }
@@ -18045,12 +18525,12 @@ var init_server = __esm({
       },
       {
         name: "tendril_publish_wait",
-        description: "Phase two of the browser-approved publish: waits (with live progress) for the user's Approve click on the page tendril_publish returned, then uploads the bundle, commits it, and returns the live publication URL. Call it right after relaying the approve link. A denial, a lapse, and success each come back as their own sentence \u2014 report the outcome and the URL to the user.",
+        description: 'Phase two of the browser-approved publish. Waits in a BOUNDED window (~1 minute per call) for the user\'s Approve click on the page tendril_publish returned, then uploads the bundle, commits it, and returns the live publication URL. Call it right after relaying the approve link. While the human has not decided, each call returns `status: "approval-pending"` \u2014 that is a heartbeat, not a failure: tell the user in one short line that you are still waiting (restate the approve link and the account to approve as, ONLY if they seem lost; never urge the decision), then call this again to keep waiting. The request stays live for ~30 minutes. A denial, a lapse, and success each come back as their own sentence \u2014 report the outcome, and on success lead with the live URL. A decided approval continues straight into upload and commit INSIDE the same call \u2014 that phase can take minutes and may render no progress in some hosts; that is normal, not stuck. Some hosts render no progress at all during a call; the bounded window IS the liveness, so never describe an in-flight call as stuck \u2014 and a brief liveness line roughly every few minutes is enough, you need not narrate every heartbeat (each pending return carries waitedTotalSeconds/remainingSeconds to say where the wait stands).',
         schema: z15.object({
           bundleDir: str("the same bundle directory tendril_publish was called with"),
           portal: optStr("portal origin override (must match tendril_publish's)")
         }),
-        argv: (i) => ["publish", i["bundleDir"], "--approve-wait", ...typeof i["portal"] === "string" ? ["--to", i["portal"]] : []]
+        argv: (i) => ["publish", i["bundleDir"], "--approve-wait", "--wait-window", "55", ...typeof i["portal"] === "string" ? ["--to", i["portal"]] : []]
       },
       {
         name: "tendril_record_next",
@@ -18099,14 +18579,14 @@ var init_server = __esm({
           const bridge = (label, single, parts) => {
             if (single !== void 0 && parts !== void 0) throw new Error(`pass at most one of \`${label}\` and \`${label}Parts\``);
             if (single === void 0 && parts === void 0) return;
-            const tmp = path52.join(mkdtempSync3(path52.join(os8.tmpdir(), "tendril-envelope-")), "response.txt");
+            const tmp = path53.join(mkdtempSync3(path53.join(os8.tmpdir(), "tendril-envelope-")), "response.txt");
             if (single !== void 0) {
-              writeFileSync20(tmp, single);
+              writeFileSync21(tmp, single);
               argvOut.push(`--${label}-file`, tmp);
             } else {
               const blocks = parts;
               if (blocks.length === 0) throw new Error(`\`${label}Parts\` must be a non-empty array of block texts`);
-              writeFileSync20(tmp, JSON.stringify(blocks));
+              writeFileSync21(tmp, JSON.stringify(blocks));
               argvOut.push(`--${label}-parts-file`, tmp);
             }
           };
@@ -18147,12 +18627,12 @@ var init_server = __esm({
           const file = i["file"];
           if ([text, texts, file].filter((x) => x !== void 0).length !== 1) throw new Error("pass exactly one of `text` (single-block response), `texts` (multi-block response), or `file` (a saved envelope)");
           if (file !== void 0) return [...base, "--file", file];
-          const tmp = path52.join(mkdtempSync3(path52.join(os8.tmpdir(), "tendril-envelope-")), "response.txt");
+          const tmp = path53.join(mkdtempSync3(path53.join(os8.tmpdir(), "tendril-envelope-")), "response.txt");
           if (text !== void 0) {
-            writeFileSync20(tmp, text);
+            writeFileSync21(tmp, text);
             return [...base, "--file", tmp, "--raw"];
           }
-          writeFileSync20(tmp, JSON.stringify(texts));
+          writeFileSync21(tmp, JSON.stringify(texts));
           return [...base, "--file", tmp, "--raw-parts"];
         }
       },
@@ -18212,7 +18692,7 @@ var init_server = __esm({
       },
       {
         name: "tendril_engine_score",
-        description: "AGENT-HARNESS engine, step 2 (the oracle): scores a candidate bundle directory against recorded truth \u2014 per-config pixels, behaviors, state parity (recording-selected \u2014 a bundle cannot unschedule it) \u2014 and returns feedback plus evidence artifacts. Iterate until allPass or two non-improving rounds. Only THIS tool's output counts as a score; never claim numbers yourself.",
+        description: "AGENT-HARNESS engine, step 2 (the oracle): scores a candidate bundle directory against recorded truth \u2014 per-config pixels, behaviors, state parity (recording-selected \u2014 a bundle cannot unschedule it) \u2014 and returns feedback plus evidence artifacts. Iterate until allPass or two non-improving rounds. Only THIS tool's output counts as a score; never claim numbers yourself. allPass ends the LOOP, not the run: finish with tendril_verify, and a green verify's terminal step is publishing \u2014 the component is done when it is LIVE, not when it scores.",
         schema: z15.object({
           taskOrSet: str("reference task name or recording-set directory"),
           candidateDir: str("directory containing the proposed bundle files"),
@@ -18255,7 +18735,7 @@ var init_server = __esm({
       },
       {
         name: "tendril_verify",
-        description: "Verify/check that a component matches its Figma design \u2014 use when the user asks whether an implementation is faithful to the design, or to re-certify an existing Tendril bundle. Recomputes full verification (per-config status, behaviors, composition, evidence artifacts). Free, account-less, network-less \u2014 the trust anchor. Exit 5 means below the target bar with an honest report \u2014 sub-bar scores, or at bar cert a config demoted by absent-ink clusters.",
+        description: "Verify/check that a component matches its Figma design \u2014 use when the user asks whether an implementation is faithful to the design, or to re-certify an existing Tendril bundle. Recomputes full verification (per-config status, behaviors, composition, evidence artifacts). Free, account-less, network-less \u2014 the trust anchor. Exit 5 means below the target bar with an honest report \u2014 sub-bar scores, or at bar cert a config demoted by absent-ink clusters. A GREEN run writes the inspect sheet itself and returns `next`: its terminal step is publishing (tendril_publish \u2192 tendril_publish_wait) \u2014 a verified component reachable only on local disk is an unfinished run; a sub-bar run never publishes.",
         schema: z15.object({
           bundleDir: str("bundle directory to verify"),
           bar: optStr("pass (default) or cert"),
@@ -18309,13 +18789,13 @@ __export(permissions_exports, {
   runPermissions: () => runPermissions,
   writeSelection: () => writeSelection
 });
-import { existsSync as existsSync43, mkdirSync as mkdirSync13, readFileSync as readFileSync39, writeFileSync as writeFileSync21 } from "node:fs";
+import { existsSync as existsSync44, mkdirSync as mkdirSync13, readFileSync as readFileSync40, writeFileSync as writeFileSync22 } from "node:fs";
 import os9 from "node:os";
-import path53 from "node:path";
+import path54 from "node:path";
 function mergeAllowlist(file, entries, denyEntries = []) {
   let settings = {};
-  if (existsSync43(file) && readFileSync39(file, "utf8").trim() !== "") {
-    settings = JSON.parse(readFileSync39(file, "utf8"));
+  if (existsSync44(file) && readFileSync40(file, "utf8").trim() !== "") {
+    settings = JSON.parse(readFileSync40(file, "utf8"));
     if (settings === null || typeof settings !== "object" || Array.isArray(settings)) throw new Error("settings root is not an object");
   }
   const permissions = settings["permissions"] ??= {};
@@ -18335,8 +18815,8 @@ function mergeAllowlist(file, entries, denyEntries = []) {
   }
   if (added.length > 0 || denyAdded.length > 0) {
     allow.push(...added);
-    mkdirSync13(path53.dirname(file), { recursive: true });
-    writeFileSync21(file, `${JSON.stringify(settings, null, 2)}
+    mkdirSync13(path54.dirname(file), { recursive: true });
+    writeFileSync22(file, `${JSON.stringify(settings, null, 2)}
 `);
   }
   return { added, alreadyPresent, denyAdded };
@@ -18400,7 +18880,7 @@ async function runPermissions(flags) {
   }
   if (flags.write) {
     const base = process.env["INIT_CWD"] ?? process.cwd();
-    const file = flags.user ? path53.join(os9.homedir(), ".claude", "settings.json") : path53.join(base, ".claude", "settings.local.json");
+    const file = flags.user ? path54.join(os9.homedir(), ".claude", "settings.json") : path54.join(base, ".claude", "settings.local.json");
     const { entries, denyEntries } = writeSelection(result, flags.user === true);
     if (flags.dryRun) {
       emitData(flags, { file, wouldAdd: entries, wouldDeny: denyEntries }, () => {
@@ -18543,168 +19023,6 @@ var init_permissions = __esm({
   }
 });
 
-// packages/cli/src/commands/inspect.ts
-var inspect_exports = {};
-__export(inspect_exports, {
-  INSPECT_DESCRIPTION: () => INSPECT_DESCRIPTION,
-  runInspect: () => runInspect
-});
-import { existsSync as existsSync44, readFileSync as readFileSync40, writeFileSync as writeFileSync22 } from "node:fs";
-import path54 from "node:path";
-function readVerifyReport(evidenceDir) {
-  const p = path54.join(evidenceDir, VERIFY_REPORT_FILENAME);
-  if (!existsSync44(p)) return void 0;
-  try {
-    return JSON.parse(readFileSync40(p, "utf8"));
-  } catch {
-    return void 0;
-  }
-}
-function verdictBlock(report) {
-  if (report === void 0) {
-    return `<div class="verdict none"><h2>No verdict on file</h2><p>This evidence carries no <code>${VERIFY_REPORT_FILENAME}</code>, so these images are unlabelled pixels \u2014 nothing here says what passed. Re-run <code>tendril verify</code> to write one.</p></div>`;
-  }
-  const buckets = /* @__PURE__ */ new Map();
-  for (const c of report.configs) buckets.set(c.status, (buckets.get(c.status) ?? 0) + 1);
-  const split = [...buckets.entries()].map(([k, n]) => `<span class="tier t-${esc(k)}">${n} ${esc(k)}</span>`).join("");
-  const failed = report.behaviors.filter((b) => !b.pass);
-  return `<div class="verdict ${report.verdict === "verified" ? "ok" : "bad"}"><h2>${esc(report.verdict)} <small>at bar \u201C${esc(report.targetBar)}\u201D</small></h2><p class="tiers">${split}<span class="tier">${report.behaviors.length - failed.length}/${report.behaviors.length} behaviors</span></p>` + (failed.length > 0 ? `<ul class="fails">${failed.map((b) => `<li><code>${esc(b.id)}</code>${b.detail !== void 0 ? ` \u2014 ${esc(b.detail)}` : ""}</li>`).join("")}</ul>` : "") + (report.verdictCaveats.length > 0 ? `<h3>What was never asked</h3><ul class="caveats">${report.verdictCaveats.map((c) => `<li>${esc(c)}</li>`).join("")}</ul>` : `<p class="caveats">No caveats: every question this bar asks was answered.</p>`) + `</div>`;
-}
-function scoreLine(report, rep) {
-  const c = report?.configs.find((x) => x.rep === rep);
-  if (c === void 0) return "";
-  const ex = c.exact !== void 0 ? ` <span class="exact">measured ${c.exact.similarity.toFixed(6)} / ${c.exact.inkRecall.toFixed(6)}</span>` : "";
-  const why = Array.isArray(c.demotedBy) && c.demotedBy.length > 0 ? `<span class="demoted">demoted: ${esc(c.demotedBy.join("; "))}</span>` : "";
-  const err = typeof c.error === "string" ? `<span class="demoted">${esc(c.error)}</span>` : "";
-  return `<p class="scores"><span class="tier t-${esc(c.status)}">${esc(c.status)}</span> sim ${c.similarity} \xB7 ink ${c.inkRecall}${ex} ${why} ${err}</p>`;
-}
-async function runInspect(opts) {
-  if (opts.describe) {
-    printDescription(INSPECT_DESCRIPTION);
-    return;
-  }
-  const bundleDir = path54.resolve(opts.bundleDir);
-  const evidenceDir = path54.join(bundleDir, "verify-evidence");
-  const manifestPath2 = path54.join(bundleDir, "component.json");
-  if (!existsSync44(evidenceDir) || !existsSync44(manifestPath2)) {
-    fail(opts, ExitCode.InputValidation, {
-      error: `nothing to inspect in ${bundleDir} \u2014 ${existsSync44(manifestPath2) ? "no verify-evidence directory" : "no component.json"}`,
-      code: "no-evidence",
-      remediation: `Run \`${tendrilCommand(`verify ${bundleDir}`)}\` first \u2014 inspect reads the ref/render evidence that run writes.`
-    });
-  }
-  const { manifest } = readBundleManifest(readFileSync40(manifestPath2, "utf8"));
-  if (manifest === void 0) {
-    fail(opts, ExitCode.InputValidation, {
-      error: "component.json did not parse as a bundle manifest",
-      code: "no-mount-contract",
-      remediation: "Re-emit the bundle (score/verify rewrite component.json), then re-run inspect."
-    });
-  }
-  const setDir = path54.resolve(opts.set ?? manifest.provenance.recordingSet.path);
-  const report = readVerifyReport(evidenceDir);
-  const reps = Object.keys(manifest.propAdapter).filter((rep) => existsSync44(path54.join(evidenceDir, `${rep}-ref.png`)) && existsSync44(path54.join(evidenceDir, `${rep}-render.png`)));
-  if (reps.length === 0) {
-    fail(opts, ExitCode.InputValidation, {
-      error: "verify-evidence holds no ref/render pairs for this bundle's configs",
-      code: "no-evidence",
-      remediation: `Run \`${tendrilCommand(`verify ${bundleDir}`)}\` first \u2014 inspect reads the ref/render evidence that run writes.`
-    });
-  }
-  let crops = 0;
-  const sections = [];
-  for (const rep of reps) {
-    const ref = new Uint8Array(readFileSync40(path54.join(evidenceDir, `${rep}-ref.png`)));
-    const render = new Uint8Array(readFileSync40(path54.join(evidenceDir, `${rep}-render.png`)));
-    const nodes = smallSemanticNodes(setDir, rep, opts.maxArea ?? 1024).slice(0, 12);
-    const cells = [];
-    for (const [i, n] of nodes.entries()) {
-      const rect = { x: n.x, y: n.y, w: n.w, h: n.h };
-      try {
-        writeFileSync22(path54.join(evidenceDir, `${rep}-inspect-${i}-ref.png`), zoomCrop(ref, rect));
-        writeFileSync22(path54.join(evidenceDir, `${rep}-inspect-${i}-render.png`), zoomCrop(render, rect));
-      } catch {
-        continue;
-      }
-      crops += 1;
-      cells.push(
-        `<figure><figcaption>${esc(n.name)} <code>${esc(n.id)}</code> \xB7 ${n.w}\xD7${n.h}</figcaption><div class="pair"><span><em>recorded</em><img src="./${rep}-inspect-${i}-ref.png" alt="recorded ${esc(n.name)}"></span><span><em>rendered</em><img src="./${rep}-inspect-${i}-render.png" alt="rendered ${esc(n.name)}"></span></div></figure>`
-      );
-    }
-    sections.push(
-      `<section><h2>${esc(rep)}</h2>` + scoreLine(report, rep) + `<div class="full"><span><em>recorded</em><img src="./${rep}-ref.png"></span><span><em>rendered</em><img src="./${rep}-render.png"></span><span><em>diff</em><img src="./${rep}-diff.png"></span></div>` + (cells.length > 0 ? `<div class="grid">${cells.join("")}</div>` : `<p class="none">no small recorded nodes in this config's sweep</p>`) + `</section>`
-    );
-  }
-  for (const c of report?.configs ?? []) {
-    if (reps.includes(c.rep)) continue;
-    sections.push(`<section class="missing"><h2>${esc(c.rep)}</h2>${scoreLine(report, c.rep)}<p class="none">No evidence images for this config \u2014 it was scored, but nothing was captured to look at.</p></section>`);
-  }
-  const sheet = path54.join(evidenceDir, "inspect.html");
-  writeFileSync22(
-    sheet,
-    `<!doctype html><meta charset="utf-8"><title>${esc(manifest.name)} \u2014 tendril inspect</title><style>
-body{font:14px/1.45 system-ui,sans-serif;margin:24px;background:#fff;color:#111}
-h1{font-size:20px} h2{font-size:16px;border-top:1px solid #ddd;padding-top:16px}
-.pair,.full{display:flex;gap:12px;flex-wrap:wrap;align-items:flex-start}
-.full img{max-width:400px;border:1px solid #ccc} .pair img{border:1px solid #ccc;image-rendering:pixelated}
-figure{margin:0 0 16px} figcaption{margin-bottom:4px} em{display:block;color:#666;font-style:normal;font-size:12px}
-.grid{display:flex;flex-wrap:wrap;gap:20px;margin-top:12px} .none{color:#666}
-.verdict{border:1px solid #ddd;border-left-width:5px;padding:12px 16px;margin:16px 0;background:#fafafa}
-.verdict.ok{border-left-color:#1a7f37} .verdict.bad{border-left-color:#b35900} .verdict.none{border-left-color:#999}
-.verdict h2{border:0;padding:0;margin:0 0 8px} .verdict h3{font-size:13px;margin:12px 0 4px;color:#444}
-.verdict small{font-weight:400;color:#666}
-.tiers{margin:0;display:flex;gap:8px;flex-wrap:wrap}
-.tier{display:inline-block;padding:1px 8px;border:1px solid #ccc;border-radius:10px;font-size:12px;background:#fff}
-.t-certified{border-color:#1a7f37;color:#1a7f37} .t-pass{border-color:#8a6d00;color:#8a6d00} .t-fail{border-color:#b3261e;color:#b3261e}
-.caveats,.fails{margin:4px 0 0;padding-left:20px;color:#444} .caveats li,.fails li{margin:2px 0}
-.scores{margin:4px 0 10px;color:#333} .exact{color:#666;font-size:12px} .demoted{color:#b3261e;font-size:12px;margin-left:8px}
-.missing{opacity:.85} .legend{white-space:pre-wrap;font:12px/1.4 ui-monospace,SFMono-Regular,Menlo,monospace;background:#fafafa;border:1px solid #ddd;padding:12px;overflow-x:auto}
-</style><h1>${esc(manifest.name)} \u2014 verdict and evidence</h1>
-${verdictBlock(report)}
-<p>Below, every crop is a recorded node small enough that global metrics weight it as a rounding error.
-Scan the pairs: anything present on the left and missing/invisible on the right is a defect,
-whatever the scores said. Verdicts come from <code>tendril verify</code> \u2014 this sheet only shows.</p>
-${sections.join("\n")}
-<section><h2>Diff colours</h2><div class="legend">${esc(DIFF_LEGEND_TEXT)}</div></section>
-`
-  );
-  emitData(opts, { sheet, configs: reps.length, crops }, () => {
-    process.stdout.write(`inspect sheet: ${sheet}
-${reps.length} config(s), ${crops} detail crop pair(s) \u2014 open the sheet and scan recorded vs rendered
-`);
-  });
-}
-var INSPECT_DESCRIPTION, esc;
-var init_inspect = __esm({
-  "packages/cli/src/commands/inspect.ts"() {
-    "use strict";
-    init_src3();
-    init_src4();
-    init_src5();
-    init_describe();
-    init_invocation();
-    init_output();
-    INSPECT_DESCRIPTION = {
-      name: "inspect",
-      summary: "Build an eye-verifiable detail sheet from verify evidence: magnified ref-vs-render crops of every small recorded node (icons, controls, marks).",
-      args: [{ name: "bundleDir", required: true, description: "bundle directory (must carry component.json and a verify-evidence dir from a prior `tendril verify`)" }],
-      flags: [
-        { flag: "--set <dir>", description: "recording set override (default: the bundle's provenance path)" },
-        { flag: "--max-area <px2>", description: "node area ceiling for the detail sweep", default: "1024" },
-        { flag: "--json", description: "Machine-readable output" }
-      ],
-      output: {
-        sheet: "string \u2014 path to the generated inspect.html",
-        configs: "number \u2014 configs with evidence found",
-        crops: "number \u2014 detail crop pairs written"
-      },
-      exitCodes: { 0: "sheet written", 3: "no verify evidence to inspect (run `tendril verify` first)" },
-      examples: ["tendril inspect ./src/components/Banner", "tendril inspect ./bundle --set ./tendril/recordings/banner"]
-    };
-    esc = (s) => s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
-  }
-});
-
 // packages/cli/src/commands/login.ts
 var login_exports = {};
 __export(login_exports, {
@@ -19280,12 +19598,28 @@ var init_share = __esm({
 // packages/cli/src/commands/publish.ts
 var publish_exports = {};
 __export(publish_exports, {
+  approveWaitPhase: () => approveWaitPhase,
   resolveOrigin: () => resolveOrigin2,
-  runPublish: () => runPublish
+  runPublish: () => runPublish,
+  spendPendingApproval: () => spendPendingApproval
 });
 import { existsSync as existsSync47, readFileSync as readFileSync43, rmSync as rmSync10, writeFileSync as writeFileSync25 } from "node:fs";
 import path57 from "node:path";
 async function runPublish(opts) {
+  if (opts.waitWindowSeconds !== void 0 && opts.approveWait !== true) {
+    fail(opts, ExitCode.InputValidation, {
+      error: "--wait-window only bounds an --approve-wait poll",
+      code: "wait-window-without-approve-wait",
+      remediation: "Pass --approve-wait with it, or drop --wait-window."
+    });
+  }
+  if (opts.waitWindowSeconds !== void 0 && (!Number.isFinite(opts.waitWindowSeconds) || opts.waitWindowSeconds <= 0)) {
+    fail(opts, ExitCode.InputValidation, {
+      error: "--wait-window needs a positive number of seconds",
+      code: "wait-window-invalid",
+      remediation: "Pass e.g. --wait-window 55."
+    });
+  }
   const bundleDir = path57.resolve(opts.bundleDir);
   const bundle = readBundle(opts, bundleDir);
   const report = bundle.report;
@@ -19399,9 +19733,11 @@ async function runPublish(opts) {
   const origin = resolveOrigin2(opts);
   const client = opts.client ?? httpClient(opts, origin);
   if (opts.approveWait === true) {
-    await approveWaitPhase(opts, client, bundleDir, { componentName, figmaFile });
+    const phase = await approveWaitPhase(opts, client, bundleDir, { componentName, figmaFile });
+    if (phase === "yielded") return;
   }
   void reportRunPresence(componentName, "publishing");
+  emitProgress(0, 1, "requesting the upload plan from the portal");
   let opened = await client.begin({
     componentName,
     figmaFile,
@@ -19428,6 +19764,7 @@ async function runPublish(opts) {
     }
     refuse2(opts, opened, "publish-refused");
   }
+  if (opts.approveWait === true) spendPendingApproval();
   const uploaded = [];
   for (const object of opened.value.plan.objects) {
     const file = path57.join(bundleDir, object.relPath);
@@ -19447,6 +19784,7 @@ async function runPublish(opts) {
     uploaded.push({ relPath: object.relPath, deduplicated: sent.value.deduplicated });
     emitProgress(uploaded.length, opened.value.plan.objects.length, `uploading ${object.relPath}`);
   }
+  emitProgress(uploaded.length, uploaded.length, "upload complete \u2014 committing the publication");
   const committed = await client.commit({ publicationId: opened.value.publicationId });
   if (committed.ok) {
     await endRunPresence(componentName);
@@ -19588,7 +19926,7 @@ async function runApprovalFlow(opts, client, bundleDir, input) {
   const who = await client.whoami?.();
   const asAccount = who?.ok === true && who.value.email !== "" ? ` signed in as ${who.value.email}` : "";
   if (opts.approveStart === true) {
-    const pending = { ...approval, bundleDir, componentName: input.componentName, figmaFile: input.figmaFile };
+    const pending = { ...approval, bundleDir, componentName: input.componentName, figmaFile: input.figmaFile, requestedAt: (/* @__PURE__ */ new Date()).toISOString() };
     writeFileSync25(pendingApprovalPath(), `${JSON.stringify(pending, null, 2)}
 `, { mode: 384 });
     await endRunPresence(input.componentName);
@@ -19621,7 +19959,7 @@ async function runApprovalFlow(opts, client, bundleDir, input) {
   const decided = await waitForApproval(opts, client, approval);
   if (decided === "approved") return input.begin();
   await endRunPresence(input.componentName);
-  failDecision(opts, decided);
+  failDecision(opts, decided === "window-elapsed" ? "expired" : decided);
 }
 async function approveWaitPhase(opts, client, bundleDir, subject) {
   const file = pendingApprovalPath();
@@ -19651,12 +19989,41 @@ async function approveWaitPhase(opts, client, bundleDir, subject) {
   }
   const done = () => rmSync10(file, { force: true });
   const decided = await waitForApproval(opts, client, pending);
-  done();
-  if (decided !== "approved") failDecision(opts, decided);
+  if (decided === "window-elapsed") {
+    const who = await client.whoami?.();
+    const asAccount = who?.ok === true && who.value.email !== "" ? who.value.email : void 0;
+    emitData(
+      opts,
+      {
+        status: "approval-pending",
+        approveUrl: pending.approveUrl,
+        ...asAccount !== void 0 ? { approveAsAccount: asAccount } : {},
+        expiresAt: pending.expiresAt,
+        windowSeconds: opts.waitWindowSeconds ?? 0,
+        ...pending.requestedAt !== void 0 ? { waitedTotalSeconds: Math.max(0, Math.round((Date.now() - Date.parse(pending.requestedAt)) / 1e3)) } : {},
+        remainingSeconds: Math.max(0, Math.round((Date.parse(pending.expiresAt) - Date.now()) / 1e3)),
+        next: "the approval request is STILL LIVE and undecided \u2014 tell the user in one short line you are still waiting for their Approve click (restate the approve link and the account to approve as, ONLY if they seem lost; never urge the decision), then run the wait again to keep waiting"
+      },
+      () => {
+        process.stdout.write(`Still waiting for the browser approval (wait window elapsed; the request stays live until ${pending.expiresAt.slice(11, 16)} UTC): ${pending.approveUrl}
+`);
+      }
+    );
+    return "yielded";
+  }
+  if (decided !== "approved") {
+    done();
+    failDecision(opts, decided);
+  }
+  return "proceed";
+}
+function spendPendingApproval() {
+  rmSync10(pendingApprovalPath(), { force: true });
 }
 async function waitForApproval(opts, client, approval) {
   const interval = Math.max(1, approval.pollSeconds) * 1e3;
-  const total = Math.ceil(APPROVAL_WAIT_CAP_MS / interval);
+  const capMs = opts.waitWindowSeconds !== void 0 ? Math.max(1, opts.waitWindowSeconds) * 1e3 : APPROVAL_WAIT_CAP_MS;
+  const total = Math.ceil(capMs / interval);
   for (let tick = 1; tick <= total; tick += 1) {
     const polled = await client.pollApproval({ approvalId: approval.approvalId });
     if (!polled.ok) refuse2(opts, polled, "approval-poll-refused");
@@ -19664,7 +20031,7 @@ async function waitForApproval(opts, client, approval) {
     emitProgress(tick, total, "waiting for the browser approval");
     await new Promise((resolve) => setTimeout(resolve, interval));
   }
-  return "expired";
+  return opts.waitWindowSeconds !== void 0 ? "window-elapsed" : "expired";
 }
 function failDecision(opts, decided) {
   if (decided === "denied") {
@@ -21178,7 +21545,7 @@ function buildProgram() {
       ...local["revoke"] !== void 0 ? { revoke: local["revoke"] } : {}
     });
   });
-  program.command("publish").description("Put a verified bundle and its evidence on a page, at a URL you can send to someone. Refuses a run the ruler declined.").argument("<bundleDir>", "bundle directory that has already been verified").option("--to <url>", "the portal to publish to (or set TENDRIL_PORTAL_URL)").option("--name <name>", "library label for this component (default: the bundle manifest's own name)").option("--approve-start", "first publish only: request the browser approval, print the link, persist the pending state and exit \u2014 the tendril_publish tool's phase one").option("--approve-wait", "resume a pending approval: poll until the human decides in the browser, then publish \u2014 phase two").action(async (bundleDir, _o, cmd) => {
+  program.command("publish").description("Put a verified bundle and its evidence on a page, at a URL you can send to someone. Refuses a run the ruler declined.").argument("<bundleDir>", "bundle directory that has already been verified").option("--to <url>", "the portal to publish to (or set TENDRIL_PORTAL_URL)").option("--name <name>", "library label for this component (default: the bundle manifest's own name)").option("--approve-start", "first publish only: request the browser approval, print the link, persist the pending state and exit \u2014 the tendril_publish tool's phase one").option("--approve-wait", "resume a pending approval: poll until the human decides in the browser, then publish \u2014 phase two").option("--wait-window <seconds>", "with --approve-wait: return after this many undecided seconds (exit 0, status approval-pending, the pending slot kept) instead of blocking to the 31-minute cap \u2014 the MCP bridge's bounded-poll shape").action(async (bundleDir, _o, cmd) => {
     const flags = globalFlags(cmd.parent);
     const local = cmd.opts();
     const { runPublish: runPublish2 } = await Promise.resolve().then(() => (init_publish(), publish_exports));
@@ -21188,7 +21555,10 @@ function buildProgram() {
       ...local["to"] !== void 0 ? { to: local["to"] } : {},
       ...local["name"] !== void 0 ? { name: local["name"] } : {},
       ...local["approveStart"] !== void 0 ? { approveStart: local["approveStart"] } : {},
-      ...local["approveWait"] !== void 0 ? { approveWait: local["approveWait"] } : {}
+      ...local["approveWait"] !== void 0 ? { approveWait: local["approveWait"] } : {},
+      // Parsed, never filtered: a bad value must refuse loudly in
+      // runPublish, not silently become the unbounded wait.
+      ...local["waitWindow"] !== void 0 ? { waitWindowSeconds: Number.parseFloat(local["waitWindow"]) } : {}
     });
   });
   program.command("verify").description("Recompute verification for a generated bundle against its recording set (per-config status, behaviors, honest exit codes).").argument("<bundleDir>", "bundle directory to verify").option("--task <name>", "legacy task adapter for bundles WITHOUT component.json (bundle v1 carries its own prop manifest)").option("--set <dir>", "recording set directory (overrides the bundle's provenance path)").option("--bar <bar>", "target bar: pass (0.95) or cert (0.97)", "pass").option("--library <dir>", "workspace root holding confirmed partners generated bundles (ADR-013 composed pins; default: current directory)").option("--profile <file>", "a `tendril profile` artifact; reports whether the bundle followed your codebase conventions (never gates the verdict)").option("--hover-timeout <ms>", "hover actionability budget in ms (default 2000) \u2014 for diagnosing a slow machine; a non-default value is recorded in the report as a verdict caveat, never silently").action(async (bundleDir, _opts, cmd) => {