@tendrilapp/cli 0.1.6 → 0.1.8

package/dist/tendril-mcp.js

@@ -158,7 +158,8 @@ var TOOLS = [
       candidateDir: str("directory containing the proposed bundle files"),
       bar: optStr("pass (default) or cert"),
       host: optStr("your host identity (e.g. claude-code, cursor, codex) \u2014 recorded as self-reported provenance"),
-      model: str("the model that proposed the candidate \u2014 REQUIRED; recorded as self-reported provenance, and the CLI refuses to score without it")
+      model: str("the model that proposed the candidate \u2014 REQUIRED; recorded as self-reported provenance, and the CLI refuses to score without it"),
+      rebind: z.boolean().optional().describe("explicitly re-bind an already-bound bundle to a DIFFERENT recording set \u2014 scoring refuses this otherwise, because rebinding silently rewrites the bundle's verification identity; only pass after telling the user")
     }),
     argv: (i) => [
       "engine",
@@ -168,7 +169,26 @@ var TOOLS = [
       ...i["bar"] !== void 0 ? ["--bar", i["bar"]] : [],
       ...i["host"] !== void 0 ? ["--host", i["host"]] : [],
       "--model",
-      i["model"]
+      i["model"],
+      ...i["rebind"] === true ? ["--rebind"] : []
+    ]
+  },
+  {
+    name: "tendril_codeconnect",
+    description: "Emit a Figma Code Connect template (.figma.ts) for a certified bundle \u2014 every Figma variant value mapped to its verified prop fragment from recorded truth, stamped with the bundle's trust statement. EXTRA VALUE step after verify passes: offer it to the user. Publishing is the USER'S action (their Figma token, Organization/Enterprise plan) \u2014 via npx @figma/code-connect connect publish, or the Figma MCP's own add_code_connect_map/send_code_connect_mappings tools if available in this session.",
+    schema: z.object({
+      bundleDir: str("bundle directory (carries component.json)"),
+      figmaUrl: str("figma.com /design/ URL of the COMPONENT SET, with node-id (ask the user to Copy link to selection if you don't have it)"),
+      set: optStr("recording set override (default: the bundle's provenance path)"),
+      out: optStr("output file path (default: <bundle>/<Component>.figma.ts)")
+    }),
+    argv: (i) => [
+      "codeconnect",
+      i["bundleDir"],
+      "--figma-url",
+      i["figmaUrl"],
+      ...i["set"] !== void 0 ? ["--set", i["set"]] : [],
+      ...i["out"] !== void 0 ? ["--out", i["out"]] : []
     ]
   },
   {

package/dist/tendril.js

@@ -414,26 +414,32 @@ function toNode(tag, attrs) {
   if (attrs["hidden"] === "true") node.hidden = true;
   return node;
 }
-function parseMetadataStructure(response) {
+function parseMetadataForest(response) {
   const stack = [];
-  let root;
+  const roots = [];
   for (const m of response.matchAll(TAG_RE)) {
     const [, closing, tag, rawAttrs, selfClosing] = m;
     if (closing === "/") {
       const done = stack.pop();
-      if (done !== void 0 && stack.length === 0 && root === void 0) root = done;
+      if (done !== void 0 && stack.length === 0) roots.push(done);
       continue;
     }
     const node = toNode(tag.toLowerCase(), parseAttrs(rawAttrs));
     const parent = stack[stack.length - 1];
     if (parent !== void 0) parent.children.push(node);
     if (selfClosing === "/") {
-      if (stack.length === 0 && root === void 0) root = node;
+      if (stack.length === 0) roots.push(node);
       continue;
     }
     stack.push(node);
   }
-  if (root === void 0) root = stack[0];
+  const truncated = stack.length > 0;
+  if (truncated && stack[0] !== void 0) roots.push(stack[0]);
+  return { roots, truncated };
+}
+function parseMetadataStructure(response) {
+  const { roots } = parseMetadataForest(response);
+  const root = roots[0];
   if (root === void 0) {
     throw new Error("get_metadata response contains no parseable structure");
   }
@@ -878,7 +884,7 @@ function planQueue(symbols, opts = {}) {
         if (axes === void 0) {
           reps.push({ slug: slugify(kebab2(sym.name) || sym.nodeId.replace(":", "-")), nodeId: sym.nodeId, ...sym.sourceFrame !== void 0 ? { sourceFrame: sym.sourceFrame } : {}, tier: "singleton" });
         } else {
-          reps.push({ slug: slugify(kebab2(Object.values(axes).join("-"))), nodeId: sym.nodeId, ...sym.sourceFrame !== void 0 ? { sourceFrame: sym.sourceFrame } : {}, tier: "anchor", axes });
+          reps.push({ slug: slugify(kebab2(Object.values(axes).join("-")) || sym.nodeId.replace(":", "-")), nodeId: sym.nodeId, ...sym.sourceFrame !== void 0 ? { sourceFrame: sym.sourceFrame } : {}, tier: "anchor", axes });
         }
       }
       continue;
@@ -898,11 +904,13 @@ function planQueue(symbols, opts = {}) {
         reps.push({ slug: slugify("anchor"), nodeId: sym.nodeId, ...frame, tier: "anchor", axes });
       } else if (diffs.length === 1) {
         const k = diffs[0];
-        reps.push({ slug: slugify(kebab2(`${k}-${axes[k]}`)), nodeId: sym.nodeId, ...frame, tier: "one-factor", axes });
+        reps.push({ slug: slugify(kebab2(`${k}-${axes[k]}`) || `pose-${sym.nodeId.replace(":", "-")}`), nodeId: sym.nodeId, ...frame, tier: "one-factor", axes });
       } else if (diffs.length === 2 && diffs.some((k) => crossAxes.includes(k.toLowerCase()))) {
-        reps.push({ slug: slugify(kebab2(`cross-${diffs.map((k) => axes[k]).join("-")}`)), nodeId: sym.nodeId, ...frame, tier: "cross", axes });
+        reps.push({ slug: slugify(kebab2(`cross-${diffs.map((k) => axes[k]).join("-")}`) || `cross-${sym.nodeId.replace(":", "-")}`), nodeId: sym.nodeId, ...frame, tier: "cross", axes });
+      } else if (opts.sample !== true) {
+        reps.push({ slug: slugify(kebab2(`cross-${diffs.map((k) => `${k}-${axes[k]}`).join("-")}`) || `cross-${sym.nodeId.replace(":", "-")}`), nodeId: sym.nodeId, ...frame, tier: "cross", axes });
       } else {
-        notRecorded.push({ nodeId: sym.nodeId, name: sym.name, reason: `${diffs.length}-factor pose outside the queue rule (diffs: ${diffs.join(", ")})` });
+        notRecorded.push({ nodeId: sym.nodeId, name: sym.name, reason: `${diffs.length}-factor pose outside the SAMPLED queue rule (diffs: ${diffs.join(", ")}) \u2014 sampling is blind to multi-axis interactions; re-plan without --sample for the full matrix` });
       }
     }
   }
@@ -940,6 +948,27 @@ function planSet(setDir, component, symbols, opts = {}) {
     const wantsNewDefaults = opts.defaults !== void 0 && JSON.stringify(opts.defaults) !== JSON.stringify(existing.defaults ?? {});
     const anythingRecorded = existing.reps.some((r) => RECORD_TOOLS.some((t) => existsSync(path.join(setDir, r.slug, `${t}.json`))));
     if (!wantsNewDefaults || anythingRecorded) {
+      if (opts.sample !== true) {
+        const known = new Set(existing.reps.map((r) => r.nodeId));
+        const fullPlan = planQueue(symbols, { ...opts, sample: false });
+        const usedSlugs = new Set(existing.reps.map((r) => r.slug));
+        const missing = fullPlan.reps.filter((r) => !known.has(r.nodeId));
+        if (missing.length > 0) {
+          const appended = missing.map((r) => {
+            let slug = r.slug;
+            let n = 2;
+            while (usedSlugs.has(slug)) slug = `${r.slug}-${n++}`;
+            usedSlugs.add(slug);
+            return { slug, nodeId: r.nodeId, ...r.sourceFrame !== void 0 ? { sourceFrame: r.sourceFrame } : {} };
+          });
+          existing.reps.push(...appended);
+          existing.planMode = "full";
+          delete existing.notRecorded;
+          writeFileSync(manifestPath(setDir), `${JSON.stringify(existing, null, 1)}
+`);
+          return { manifest: existing, plan: { reps: [], notRecorded: [] }, resumed: true, toppedUp: appended.map((a) => ({ slug: a.slug, nodeId: a.nodeId })) };
+        }
+      }
       return { manifest: existing, plan: { reps: [], notRecorded: [] }, resumed: true };
     }
   }
@@ -955,6 +984,7 @@ function planSet(setDir, component, symbols, opts = {}) {
       return variants.length > 0 ? { latticeNames: variants } : {};
     })(),
     reps: plan.reps.map((r) => ({ slug: r.slug, nodeId: r.nodeId, ...r.sourceFrame !== void 0 ? { sourceFrame: r.sourceFrame } : {} })),
+    planMode: opts.sample === true ? "sample" : "full",
     ...plan.notRecorded.length > 0 ? { notRecorded: plan.notRecorded.map((n) => `${n.name} (${n.nodeId}): ${n.reason}`).join("; ") } : {}
   };
   mkdirSync(setDir, { recursive: true });
@@ -1071,6 +1101,10 @@ var init_session = __esm({
        * domains: the API must cover the lattice even where only a subset
        * is recorded. */
       latticeNames: z4.array(z4.string()).optional(),
+      /** Which planning mode produced this queue. Absent = planned before
+       * the full-matrix default (i.e. sampled) — resume uses this to
+       * top-up rather than silently perpetuating a sampled queue. */
+      planMode: z4.enum(["full", "sample"]).optional(),
       roles: z4.unknown().optional()
     });
     manifestPath = (setDir) => path.join(setDir, "recording-set.json");
@@ -1178,8 +1212,8 @@ var init_src = __esm({
 function variableNameToPath(name) {
   return name.split("/").map(canonicalCssIdentPart).filter((part) => part.length > 0);
 }
-function tokenPathToCssVar(path33) {
-  return `--${path33.join("-")}`;
+function tokenPathToCssVar(path34) {
+  return `--${path34.join("-")}`;
 }
 function toDtcgToken(variable, defaultMode) {
   const modes = Object.keys(variable.valuesByMode);
@@ -1223,11 +1257,11 @@ function toDtcgToken(variable, defaultMode) {
 }
 function mapVariablesToDtcg(variables, defaultMode = "light") {
   const entries = variables.map((variable) => {
-    const path33 = variableNameToPath(variable.name);
-    if (path33.length === 0) {
+    const path34 = variableNameToPath(variable.name);
+    if (path34.length === 0) {
       throw new DtcgMappingError("empty-name", `Figma variable ${variable.id} has an empty name`);
     }
-    return { variable, path: path33 };
+    return { variable, path: path34 };
   });
   const groupPrefixes = /* @__PURE__ */ new Set();
   for (const e of entries) {
@@ -1248,21 +1282,21 @@ function mapVariablesToDtcg(variables, defaultMode = "light") {
   }
   const tokens = {};
   const flat = [];
-  for (const { variable, path: path33 } of entries) {
+  for (const { variable, path: path34 } of entries) {
     const token = toDtcgToken(variable, defaultMode);
     let group = tokens;
-    for (const segment of path33.slice(0, -1)) {
+    for (const segment of path34.slice(0, -1)) {
       const existing = group[segment];
       group = existing ?? (group[segment] = {});
     }
-    const leaf = path33[path33.length - 1];
+    const leaf = path34[path34.length - 1];
     if (group[leaf] !== void 0) {
-      throw new DtcgMappingError("duplicate-path", `Duplicate token path "${path33.join(".")}" (variable ${variable.id})`);
+      throw new DtcgMappingError("duplicate-path", `Duplicate token path "${path34.join(".")}" (variable ${variable.id})`);
     }
     group[leaf] = token;
     flat.push({
-      path: path33.join("."),
-      cssVar: tokenPathToCssVar(path33),
+      path: path34.join("."),
+      cssVar: tokenPathToCssVar(path34),
       type: token.$type,
       value: token.$value
     });
@@ -1451,9 +1485,9 @@ function boundId(value) {
   return isObject(value) && typeof value["boundVariableId"] === "string" ? value["boundVariableId"] : void 0;
 }
 function resolveBinding(ctx, id) {
-  const path33 = ctx.pathById.get(id);
-  if (path33 === void 0) ctx.unresolved.add(id);
-  return path33;
+  const path34 = ctx.pathById.get(id);
+  if (path34 === void 0) ctx.unresolved.add(id);
+  return path34;
 }
 function parseVariantProps(name) {
   if (!name.includes("=")) return void 0;
@@ -1488,8 +1522,8 @@ function walk(ctx, raw) {
       if (!isObject(paint) || paint["visible"] === false) continue;
       const id = boundId(paint);
       if (id !== void 0) {
-        const path33 = resolveBinding(ctx, id);
-        if (path33 !== void 0) tokens.add(path33);
+        const path34 = resolveBinding(ctx, id);
+        if (path34 !== void 0) tokens.add(path34);
       } else if (typeof paint["color"] === "string") {
         ctx.hardcoded.push({ node: name, property, value: paint["color"] });
       }
@@ -1497,8 +1531,8 @@ function walk(ctx, raw) {
   }
   const radiusId = boundId(raw["cornerRadius"]);
   if (radiusId !== void 0) {
-    const path33 = resolveBinding(ctx, radiusId);
-    if (path33 !== void 0) tokens.add(path33);
+    const path34 = resolveBinding(ctx, radiusId);
+    if (path34 !== void 0) tokens.add(path34);
   } else if (typeof raw["cornerRadius"] === "number" && raw["cornerRadius"] !== 0) {
     ctx.hardcoded.push({ node: name, property: "border-radius", value: `${raw["cornerRadius"]}px` });
   }
@@ -1508,10 +1542,10 @@ function walk(ctx, raw) {
     layout = { mode: layoutMode === "HORIZONTAL" ? "flex-row" : "flex-column" };
     const gapId = boundId(raw["itemSpacing"]);
     if (gapId !== void 0) {
-      const path33 = resolveBinding(ctx, gapId);
-      if (path33 !== void 0) {
-        layout.gap = path33;
-        tokens.add(path33);
+      const path34 = resolveBinding(ctx, gapId);
+      if (path34 !== void 0) {
+        layout.gap = path34;
+        tokens.add(path34);
       }
     } else if (typeof raw["itemSpacing"] === "number" && raw["itemSpacing"] !== 0) {
       ctx.hardcoded.push({ node: name, property: "gap", value: `${raw["itemSpacing"]}px` });
@@ -1520,10 +1554,10 @@ function walk(ctx, raw) {
     for (const field of PADDING_FIELDS) {
       const id = boundId(raw[field]);
       if (id !== void 0) {
-        const path33 = resolveBinding(ctx, id);
-        if (path33 !== void 0) {
-          paddingPaths.push(path33);
-          tokens.add(path33);
+        const path34 = resolveBinding(ctx, id);
+        if (path34 !== void 0) {
+          paddingPaths.push(path34);
+          tokens.add(path34);
         }
       } else if (typeof raw[field] === "number" && raw[field] !== 0) {
         ctx.hardcoded.push({ node: name, property: field, value: `${raw[field]}px` });
@@ -1805,6 +1839,7 @@ var init_browser = __esm({
 
 // packages/verify/src/runtime.ts
 import { existsSync as existsSync4, mkdtempSync, symlinkSync } from "node:fs";
+import { createRequire } from "node:module";
 import os from "node:os";
 import path4 from "node:path";
 import { fileURLToPath } from "node:url";
@@ -1836,6 +1871,21 @@ function newScratchDir(prefix) {
   }
   return dir;
 }
+function reactPinPlugin() {
+  const req = createRequire(path4.join(runtimePackageRoot(), "package.json"));
+  return {
+    name: "tendril-react-pin",
+    setup(b) {
+      b.onResolve({ filter: /^react(-dom)?(\/.*)?$/ }, (args) => {
+        try {
+          return { path: req.resolve(args.path) };
+        } catch {
+          return null;
+        }
+      });
+    }
+  };
+}
 var init_runtime = __esm({
   "packages/verify/src/runtime.ts"() {
     "use strict";
@@ -3544,6 +3594,7 @@ if (root && C) createRoot(root).render(createElement(C, cfg.props));
     const bundle = await build3({
       stdin: { contents: mountSrc, resolveDir: runtimePackageRoot(), loader: "tsx" },
       nodePaths: [runtimeNodeModules()],
+      plugins: [reactPinPlugin()],
       bundle: true,
       write: false,
       format: "iife",
@@ -4136,6 +4187,7 @@ if (root && C) createRoot(root).render(createElement(C, cfg.props));
     const bundle = await build4({
       stdin: { contents: mountSrc, resolveDir: runtimePackageRoot(), loader: "tsx" },
       nodePaths: [runtimeNodeModules()],
+      plugins: [reactPinPlugin()],
       bundle: true,
       write: false,
       format: "iife",
@@ -4317,7 +4369,7 @@ var init_prelude = __esm({
 - Component root: -webkit-font-smoothing: antialiased and -moz-osx-font-smoothing: grayscale (recorded rasterization); font-synthesis: none (a missing font weight must fall back visibly, never fake-bold); color-scheme MATCHING YOUR RECORDING (light for a light capture, dark for a dark one) and direction: ltr \u2014 pin them, so the render cannot follow the viewer OS preference and drift from the capture it is graded against; isolation: isolate (own stacking context; overlay z-indexes never fight the host).
 - Interactive controls (buttons, options): touch-action: manipulation and user-select: none. Text inputs stay selectable (never user-select: none on them).
 - Scrollable popovers/menus: overscroll-behavior: contain.
-- Focus indicators bind to :focus-visible, never bare :focus. If the recording contains a focus pose, style the indicator from that recorded truth. If NO focus pose is recorded, do NOT invent ring colors/widths/offsets \u2014 an invented ring is unrecorded pixels; keep the browser's default focus indicator (leave outline in place on :focus-visible) and state the gap in your report. Text inputs match :focus-visible even on mouse click BY SPEC \u2014 that is platform-correct accessibility, never a bug to suppress with JS modality tracking.
+- Focus indicators bind to :focus-visible, never bare :focus. If the recording contains a focus pose, style the indicator from that recorded truth. If NO focus pose is recorded, do NOT invent ring colors/widths/offsets \u2014 an invented ring is unrecorded pixels; keep the browser's default indicator for keyboard focus and state the gap in your report. Text inputs match :focus-visible even on mouse click BY SPEC; the ONE permitted refinement is suppressing the indicator on a POSITIVELY OBSERVED pointer press, fail-safe toward showing it (programmatic focus, restored focus, and assistive tech all count as keyboard and keep the ring \u2014 WCAG 2.4.7 binds keyboard operation). Never suppress more broadly than an observed press, and never restyle what you kept.
 - Every animation wrapped in @media (prefers-reduced-motion: no-preference) or disabled under reduce.`;
   }
 });
@@ -4432,7 +4484,7 @@ var init_parity = __esm({
 });
 
 // packages/verify/src/composition.ts
-import { createRequire } from "node:module";
+import { createRequire as createRequire2 } from "node:module";
 import { existsSync as existsSync12, readFileSync as readFileSync10 } from "node:fs";
 import path17 from "node:path";
 import { build as build6 } from "esbuild";
@@ -4444,7 +4496,7 @@ function getFontFaces4() {
 async function compileInstrumentedMount(task, bundleDir) {
   const entryTsx = path17.join(bundleDir, task.entry);
   if (!existsSync12(entryTsx)) return { error: `${task.entry} missing` };
-  const requireFromVerify = createRequire(path17.join(VERIFY_PKG_DIR, "package.json"));
+  const requireFromVerify = createRequire2(path17.join(VERIFY_PKG_DIR, "package.json"));
   let realJsxPath;
   try {
     realJsxPath = requireFromVerify.resolve("react/jsx-runtime");
@@ -4485,7 +4537,10 @@ if (root && Main) createRoot(root).render(createElement(Main, cfg.props));
             b.onResolve({ filter: new RegExp(`^${REAL_JSX_SPEC}$`) }, () => ({ path: realJsxPath }));
             b.onLoad({ filter: /.*/, namespace: "tendril-shim" }, () => ({ contents: JSX_SHIM, resolveDir: runtimePackageRoot(), loader: "js" }));
           }
-        }
+        },
+        // AFTER the stamp shim: the shim must own react/jsx-runtime
+        // interception; the pin covers every remaining react import.
+        reactPinPlugin()
       ]
     });
     return bundle.outputFiles[0]?.text ?? "";
@@ -4741,6 +4796,7 @@ for (const id of ["first", "second"]) {
     const bundle = await build7({
       stdin: { contents: src, resolveDir: runtimePackageRoot(), loader: "tsx" },
       nodePaths: [runtimeNodeModules()],
+      plugins: [reactPinPlugin()],
       bundle: true,
       write: false,
       format: "iife",
@@ -6087,10 +6143,10 @@ function buildTrustStatement(input) {
   const unrecorded = input.latticeConfigs === null ? null : Math.max(0, input.latticeConfigs - input.scored);
   const interaction = input.interactionChecks === 0 ? "interaction behaviors NONE VERIFIED (0 checks)" : `interaction behaviors ${input.interactionPassed}/${input.interactionChecks}`;
   const prelude = input.preludeChecks === 0 ? "" : `, page hygiene ${input.preludePassed}/${input.preludeChecks}`;
-  return `Verified against recorded truth: ${input.pass}/${input.scored} recorded configs at or above the pass bar (${input.certified} certified), ${interaction}${prelude}.` + (unrecorded === null ? "" : ` ${unrecorded} lattice configs are unrecorded and UNVERIFIED.`) + ` These numbers are claims: recompute them with \`tendril verify\` \u2014 certification authority lives in the CLI ruler, never in this file.`;
+  return `Verified against recorded truth: ${input.pass}/${input.scored} recorded configs at or above the pass bar (${input.certified} certified), ${interaction}${prelude}.` + (unrecorded === null ? " Coverage denominator UNKNOWN (set predates lattice tracking): completeness is not established." : ` ${unrecorded} lattice configs are unrecorded and UNVERIFIED.`) + ` These numbers are claims: recompute them with \`tendril verify\` \u2014 certification authority lives in the CLI ruler, never in this file.`;
 }
 function cssProvenanceComment(input) {
-  const unrecorded = input.latticeConfigs === null ? "" : `; ${Math.max(0, input.latticeConfigs - input.scored)} lattice configs unverified`;
+  const unrecorded = input.latticeConfigs === null ? "; coverage denominator unknown" : `; ${Math.max(0, input.latticeConfigs - input.scored)} lattice configs unverified`;
   return `/* tendril bundle v${BUNDLE_VERSION} \u2014 ${input.pass}/${input.scored} recorded configs \u2265 pass bar, ${input.certified} certified${unrecorded}. Non-authoritative claim AT STAMP TIME \u2014 any edit invalidates it; recompute with \`tendril verify\`. */`;
 }
 function hashRecordingSet(relPaths, readFile, sha256) {
@@ -6243,8 +6299,10 @@ function symbolsFromMetadataEnvelope(file, sourceFrame) {
     const next = node.type !== "COMPONENT" && node.name !== "" ? node.name : ancestor;
     for (const child of node.children) walk2(child, next);
   };
-  walk2(parseMetadataStructure(text), void 0);
-  return symbols;
+  const forest = parseMetadataForest(text);
+  for (const root of forest.roots) walk2(root, void 0);
+  const seen = /* @__PURE__ */ new Set();
+  return { symbols: symbols.filter((sym) => seen.has(sym.nodeId) ? false : (seen.add(sym.nodeId), true)), truncated: forest.truncated };
 }
 function instanceLeads(text) {
   const seen = /* @__PURE__ */ new Map();
@@ -6269,10 +6327,13 @@ function runRecordPlan(opts) {
     defaults[spec.slice(0, eq)] = spec.slice(eq + 1);
   }
   let symbols = [];
+  let metadataTruncated = false;
   for (const spec of opts.metadataFiles) {
     const [file, frame] = spec.split("@");
     try {
-      symbols.push(...symbolsFromMetadataEnvelope(path24.resolve(file), frame));
+      const parsed = symbolsFromMetadataEnvelope(path24.resolve(file), frame);
+      symbols.push(...parsed.symbols);
+      if (parsed.truncated) metadataTruncated = true;
     } catch (err) {
       fail(opts, ExitCode.InputValidation, {
         error: `could not read metadata envelope ${file}: ${err instanceof Error ? err.message.split("\n")[0] : String(err)}`,
@@ -6337,7 +6398,10 @@ function runRecordPlan(opts) {
       }
     }
   }
-  const { manifest, plan, resumed } = planSet(opts.setDir, opts.component, symbols, Object.keys(defaults).length > 0 ? { defaults } : {});
+  if (metadataTruncated) {
+    warn(opts, "get_metadata response appears TRUNCATED (unclosed structure) \u2014 the variant list below may be incomplete. Cross-check variantsFound against the variant count Figma shows for this component set; re-fetch the metadata if lower.");
+  }
+  const { manifest, plan, resumed, toppedUp } = planSet(opts.setDir, opts.component, symbols, { ...Object.keys(defaults).length > 0 ? { defaults } : {}, ...opts.sample === true ? { sample: true } : {} });
   const defaultReports = reportAxisDefaults(symbols, Object.keys(defaults).length > 0 ? defaults : void 0);
   const toConfirm = resumed ? [] : defaultReports.filter((r) => (r.rule === "non-interaction" || r.rule === "frequency") && r.domain.length > 1);
   const callLow = manifest.reps.length * 3;
@@ -6347,6 +6411,15 @@ function runRecordPlan(opts) {
     {
       resumed,
       reps: manifest.reps,
+      // The honesty ledger: how many variants the metadata YIELDED vs
+      // how many the queue records. An agent (or user) can hold
+      // variantsFound against the count Figma's UI shows for the set —
+      // the one check that catches parse/transfer losses this pipeline
+      // cannot detect from the envelope alone.
+      variantsFound: symbols.length,
+      planMode: manifest.planMode ?? "sample",
+      ...metadataTruncated ? { metadataTruncated: true } : {},
+      ...toppedUp !== void 0 ? { toppedUp } : {},
       notRecorded: manifest.notRecorded ?? null,
       figmaCallEstimate: { reps: manifest.reps.length, calls: `~${callLow}\u2013${callHigh}` },
       ...toConfirm.length > 0 ? {
@@ -6362,8 +6435,18 @@ function runRecordPlan(opts) {
     },
     () => {
       if (resumed) {
-        process.stdout.write(`resumed existing plan (${manifest.reps.length} reps) \u2014 delete recording-set.json to re-plan
+        if (opts.sample === true && (manifest.planMode ?? "sample") === "full") {
+          process.stdout.write("NOTE: --sample has no effect on a resumed full-matrix set \u2014 delete recording-set.json to re-plan sampled (partial coverage is a deliberate choice)\n");
+        }
+        if (toppedUp !== void 0) {
+          process.stdout.write(`resumed and TOPPED UP: ${toppedUp.length} lattice pose(s) this set was missing are now planned (full-matrix default reaches existing sets)
 `);
+          for (const t of toppedUp) process.stdout.write(`  added ${t.slug} (${t.nodeId})
+`);
+        } else {
+          process.stdout.write(`resumed existing plan (${manifest.reps.length} reps, ${manifest.planMode ?? "sample"} mode) \u2014 delete recording-set.json to re-plan
+`);
+        }
         return;
       }
       for (const r of plan.reps) process.stdout.write(`planned ${r.slug.padEnd(24)} ${r.nodeId} (${r.tier})
@@ -6372,8 +6455,8 @@ function runRecordPlan(opts) {
 `);
       process.stdout.write(`estimated recording cost: ~${callLow}\u2013${callHigh} Figma calls for ${manifest.reps.length} reps
 `);
-      for (const q of toConfirm) {
-        process.stdout.write(`CONFIRM   ${q.axis}: default resolved to "${q.value}" by heuristic (${q.rule}) \u2014 ask the user; change with --default before recording
+      for (const q2 of toConfirm) {
+        process.stdout.write(`CONFIRM   ${q2.axis}: default resolved to "${q2.value}" by heuristic (${q2.rule}) \u2014 ask the user; change with --default before recording
 `);
       }
     }
@@ -7141,10 +7224,7 @@ function authorComponentApi(opts) {
   }
   const props = [];
   const forcedStates = [];
-  const propNameFor = (axis) => {
-    const name = camel(axis);
-    return RESERVED_PROPS.has(name.toLowerCase()) ? camel(`${opts.component} ${axis}`) : name;
-  };
+  const propNameFor = (axis) => axisPropName(opts.component, axis);
   for (const key of axisKeys) {
     const domain = domains.get(key);
     const def = defaults.get(key);
@@ -7412,6 +7492,7 @@ PAINT & PLATFORM TRAPS (each measured on a paid run; every one passed typecheck,
 - A native <dialog> carries user-agent padding: 1em. Override every side, or the root grows past its recorded box and every band inside shifts.
 - THE PAGE CANVAS IS NOT YOURS. Never paint the recording's page background into the component \u2014 no canvas-coloured plates across the root box, no square shadow spread carrying the canvas past the frame. The mount composites your render over the recorded canvas, so transparency wherever the recording shows canvas is both correct and scores correctly; the score report's canvasCoupling counts canvas pixels your render refuses to let the page repaint, and a component that paints the canvas is wrong on every real page.
 - TOKENS SCOPE TO YOUR ROOT CLASS, NEVER :root. Bundles compose on real pages: token names on :root collide across independently generated components and the last stylesheet loaded silently rewrites the others (measured: two colliding names flipped certified surfaces translucent). Declare every token under the component's root class.
+- WHEN TWO AXES BOTH CONTROL PAINT, THEY COMPOSE THROUGH CUSTOM PROPERTIES \u2014 one axis SETS variables, the other CONSUMES them. Direct paint rules on both axes have equal specificity, so source order silently drops one axis for exactly the crossed poses (measured: variant \xD7 tone \u2014 primary+critical rendered dark neutral instead of the recorded red; the sampled scorer never sees crossed poses, so nothing catches it but pixels in use).
 
 INTERACTION-READY BY DEFAULT: components are real controls, never static lookalikes \u2014 use the native element matching the archetype (button, input[type=radio|checkbox], select\u2026), real handlers, keyboard operability, and real state (checked/disabled/:hover/:focus-visible). Behavioral checks fail statues. (The forcing-hook rule is specified once, in the prescribed API below.) Your file runs in a bare browser bundle: it must be fully self-contained. IMPORT EVERY React API you use explicitly \u2014 e.g. import { useState, useRef, useEffect } from "react" \u2014 nothing is provided globally; a missing import crashes the mount and every config scores 0.
 
@@ -7426,7 +7507,7 @@ ${PRELUDE_CONTRACT}
 ${opts.colorScheme === void 0 ? "" : `
 RESOLVED FOR THIS RECORDING: it is ${opts.colorScheme}-mode truth, so pin color-scheme: ${opts.colorScheme} on the root. A conditional rule you have to resolve yourself is a rule you will get wrong \u2014 this is the answer, not the question.`}`;
 }
-var PoseCompletenessError, kebab3, camel, pascal, RESERVED_PROPS, isStateAxis, symbolName, STYLE_WEIGHTS2, styleWeight;
+var PoseCompletenessError, kebab3, camel, pascal, RESERVED_PROPS, axisPropName, isStateAxis, symbolName, STYLE_WEIGHTS2, styleWeight;
 var init_brief = __esm({
   "packages/generate/src/brief.ts"() {
     "use strict";
@@ -7450,6 +7531,10 @@ var init_brief = __esm({
       return c === "" ? c : c[0].toUpperCase() + c.slice(1);
     };
     RESERVED_PROPS = /* @__PURE__ */ new Set(["style", "classname", "children", "key", "ref", "id"]);
+    axisPropName = (component, axis) => {
+      const name = camel(axis);
+      return RESERVED_PROPS.has(name.toLowerCase()) ? camel(`${component} ${axis}`) : name;
+    };
     isStateAxis = (axis) => kebab3(axis) === "state";
     symbolName = (metaText) => {
       const raw = /name="([^"]*)"/.exec(metaText)?.[1];
@@ -8063,7 +8148,18 @@ function taskFromManifest(opts, manifest, setDir) {
   const unmapped = recordedSlugs.filter((s) => !adapterSlugs.includes(s));
   const adapterOnly = adapterSlugs.filter((s) => !recordedSlugs.includes(s));
   const registry = Object.values(TASKS).find((t) => path30.resolve(t.set) === path30.resolve(setDir));
-  const authored = registry === void 0 ? authorTaskFromSet(setDir) : void 0;
+  const authored = (() => {
+    if (registry !== void 0) return void 0;
+    try {
+      return authorTaskFromSet(setDir);
+    } catch (err) {
+      fail(opts, ExitCode.InputValidation, {
+        error: `cannot author the verification task from ${setDir}: ${err instanceof Error ? err.message.split("\n")[0] : String(err)}`,
+        code: "AUTHORING_FAILED",
+        remediation: "Fix the recording set (duplicate/colliding poses fail authoring by design \u2014 check `tendril record status` and the set's variant names)."
+      });
+    }
+  })();
   const behaviorSource = registry ?? authored.task;
   const task = {
     set: setDir,
@@ -8245,6 +8341,23 @@ async function runVerify(opts) {
       scoredConfigs: statuses.length,
       certified,
       pass: statuses.filter((s) => s.status !== "fail").length,
+      // LATTICE HONESTY (adversarial review, 2026-08-10): "verified"
+      // must never quietly mean "the recorded subset matched". The
+      // denominator is the set's own lattice; unrecorded poses are
+      // named in the report and the human output, on the trust anchor
+      // itself — not only in a long-gone plan output.
+      ...(() => {
+        try {
+          const setManifest = loadManifest(task.set);
+          const lattice = setManifest.latticeNames?.length;
+          return {
+            ...lattice !== void 0 ? { latticeConfigs: lattice, unrecordedConfigs: Math.max(0, lattice - statuses.length) } : { latticeConfigs: null },
+            ...setManifest.notRecorded !== void 0 && setManifest.notRecorded !== "" ? { notRecorded: setManifest.notRecorded } : {}
+          };
+        } catch {
+          return { latticeConfigs: null };
+        }
+      })(),
       // Prelude checks are page-level style hygiene and say nothing
       // about whether the component WORKS. Reporting one merged
       // "behaviors 6/6" made a component with zero interaction coverage
@@ -8349,6 +8462,18 @@ ${certified}/${statuses.length} certified \xB7 ${report.coverage.pass}/${statuse
 `
       );
     }
+    {
+      const cov = report.coverage;
+      if (typeof cov.latticeConfigs === "number" && (cov.unrecordedConfigs ?? 0) > 0) {
+        process.stdout.write(
+          `INCOMPLETE  ${cov.unrecordedConfigs} of ${cov.latticeConfigs} lattice poses were NEVER RECORDED \u2014 nothing verifies them; any implementation of those poses is inference, not verified truth. Re-plan the set (full matrix is the default) and record the missing poses.
+`
+        );
+      } else if (cov.latticeConfigs === null) {
+        process.stdout.write(`COVERAGE  denominator unknown (set predates lattice tracking) \u2014 scored configs are verified; completeness is not established
+`);
+      }
+    }
     process.stdout.write(`environment: chrome=${report.environment.chromeVersion ?? report.environment.chrome} fonts=${report.environment.fontsManifestSha256 ?? "UNRESOLVED"}
 `);
     process.stdout.write(`evidence: ${evidenceDir} (render/ref/diff per config)
@@ -8427,6 +8552,7 @@ function runEngineBrief(opts) {
   const unverified = notRecorded !== void 0 && notRecorded !== "" ? `
 
 === UNVERIFIED SURFACE (recorded-set disclosure \u2014 these poses were never recorded; nothing verifies them) ===
+DO NOT INVENT PIXELS FOR THESE POSES. Implement them ONLY as the composition of recorded per-axis truth (the custom-property composition rule: one paint axis sets variables, the other consumes) and list every such pose in your report as UNRECORDED-COMPOSED. Recording them is the real fix: re-plan the set (full matrix is the default) and record the missing poses.
 ${notRecorded}` : "";
   let fontProvisioning;
   if (existsSync25(manifestPath2)) {
@@ -8512,6 +8638,30 @@ async function runEngineScore(opts) {
       remediation: fontsUnprovenRemediation(task.set)
     });
   }
+  if (opts.rebind !== true && existsSync25(path31.join(candidateDir, "component.json"))) {
+    const prior = (() => {
+      try {
+        const read = readBundleManifest(readFileSync22(path31.join(candidateDir, "component.json"), "utf8"));
+        return read.manifest === void 0 ? { unreadable: true } : { hash: read.manifest.provenance.recordingSet.hash, path: read.manifest.provenance.recordingSet.path };
+      } catch {
+        return { unreadable: true };
+      }
+    })();
+    if (prior.unreadable === true) {
+      fail(opts, ExitCode.InputValidation, {
+        error: "this bundle carries a component.json whose recording-set binding cannot be read \u2014 refusing to overwrite an unverifiable identity",
+        code: "set-binding-unreadable",
+        remediation: "Fix or remove the bundle's component.json, or pass --rebind to overwrite it deliberately."
+      });
+    }
+    if (prior.hash !== recordingSetHash(task.set, task.configs)) {
+      fail(opts, ExitCode.InputValidation, {
+        error: `this bundle is bound to recording set "${prior.path}" (content ${prior.hash.slice(0, 12)}\u2026), which does not match "${opts.taskOrSet}" as it exists now \u2014 scoring would rewrite the bundle's verification identity and its evidence images`,
+        code: "set-rebind-refused",
+        remediation: "If this is the SAME set and it simply gained recordings since the last score, pass --rebind once to re-stamp. If it is a DIFFERENT set, score against the bundle's own set \u2014 rebinding voids its previous verification claims."
+      });
+    }
+  }
   const bar = BARS3[opts.bar];
   const evidenceDir = path31.join(candidateDir, "verify-evidence");
   const scores = await scoreBundleForTask(task, candidateDir, bar, { evidenceDir, onProgress: emitProgress });
@@ -8584,6 +8734,7 @@ var init_engine2 = __esm({
     "use strict";
     init_src3();
     init_src7();
+    init_src6();
     init_environment();
     init_font_guidance();
     init_src4();
@@ -8596,6 +8747,182 @@ var init_engine2 = __esm({
   }
 });
 
+// packages/cli/src/commands/codeconnect.ts
+var codeconnect_exports = {};
+__export(codeconnect_exports, {
+  runCodeConnect: () => runCodeConnect
+});
+import { existsSync as existsSync26, readFileSync as readFileSync23, writeFileSync as writeFileSync12 } from "node:fs";
+import path32 from "node:path";
+function runCodeConnect(opts) {
+  const callerCwd = process.env["INIT_CWD"] ?? process.cwd();
+  const bundleDir = path32.resolve(callerCwd, opts.bundleDir);
+  let url;
+  try {
+    url = new URL(opts.figmaUrl);
+  } catch {
+    url = new URL("invalid://x");
+  }
+  if (/[\u0000-\u001f\u2028\u2029]/.test(opts.figmaUrl) || !(url.hostname === "figma.com" || url.hostname.endsWith(".figma.com")) || !/\/design\//.test(url.pathname) || url.searchParams.get("node-id") === null) {
+    fail(opts, ExitCode.InputValidation, {
+      error: `--figma-url must be a clean figma.com /design/ URL carrying the COMPONENT SET's node-id, got: ${JSON.stringify(opts.figmaUrl)}`,
+      code: "codeconnect-bad-url",
+      remediation: "In Figma, select the component set and copy its link (Copy link to selection)."
+    });
+  }
+  let manifest;
+  try {
+    const read = readBundleManifest(readFileSync23(path32.join(bundleDir, "component.json"), "utf8"));
+    if (read.manifest === void 0) throw new Error(read.issues.map((i) => i.message).join("; ") || "no component.json");
+    manifest = read.manifest;
+  } catch (err) {
+    fail(opts, ExitCode.InputValidation, {
+      error: `not a Tendril bundle (component.json unreadable): ${err instanceof Error ? err.message.split("\n")[0] : String(err)}`,
+      code: "codeconnect-no-bundle",
+      remediation: "Point at a bundle produced by the Tendril pipeline (it carries component.json), and verify it first."
+    });
+  }
+  const setDir = path32.resolve(callerCwd, opts.set ?? manifest.provenance.recordingSet.path);
+  if (!existsSync26(path32.join(setDir, "recording-set.json"))) {
+    fail(opts, ExitCode.InputValidation, {
+      error: `recording set not found at ${setDir}`,
+      code: "codeconnect-no-set",
+      remediation: "Pass --set <recording-dir> (the bundle's provenance path did not resolve from this directory)."
+    });
+  }
+  let authored;
+  try {
+    authored = authorTaskFromSet(setDir);
+  } catch (err) {
+    fail(opts, ExitCode.InputValidation, {
+      error: `cannot author the API from ${setDir}: ${err instanceof Error ? err.message.split("\n")[0] : String(err)}`,
+      code: "codeconnect-authoring-failed",
+      remediation: "The set must be a complete protocol recording (tendril record status)."
+    });
+  }
+  const api = authored.api;
+  const component = api.component;
+  const recManifest = loadManifest(setDir);
+  const poseNames = recManifest.latticeNames ?? recManifest.reps.map((r) => {
+    const meta = path32.join(setDir, r.slug, "get_metadata.json");
+    if (!existsSync26(meta)) return void 0;
+    try {
+      return /name="([^"]*)"/.exec(envelopeFirstTextPart(JSON.parse(readFileSync23(meta, "utf8"))))?.[1];
+    } catch {
+      return void 0;
+    }
+  }).filter((n) => n !== void 0);
+  const axisDomains = mergeVariantAxes(poseNames) ?? {};
+  if (Object.keys(axisDomains).length === 0 && api.props.length > 0) {
+    fail(opts, ExitCode.InputValidation, {
+      error: "no variant axes recoverable from the recording manifest (no latticeNames)",
+      code: "codeconnect-no-axes",
+      remediation: "Re-plan the set with a current Tendril (lattice names persist in the manifest), or record the set fresh."
+    });
+  }
+  if (recordingSetHash(setDir, authored.task.configs) !== manifest.provenance.recordingSet.hash) {
+    fail(opts, ExitCode.InputValidation, {
+      error: "the recording set's content no longer matches the hash this bundle was scored against \u2014 its verification claims describe a different recording",
+      code: "codeconnect-set-drift",
+      remediation: "Re-run `tendril verify` (or engine score) against the current set, then re-emit."
+    });
+  }
+  const boolProps = api.props.filter((p) => p.kind === "boolean");
+  const pixelOnly = [];
+  const axisLines = [];
+  const fragmentVars = [];
+  for (const [axis, values] of Object.entries(axisDomains)) {
+    const varName = `frag${axisLines.length}`;
+    const entries = [];
+    const owner = api.props.find((p) => p.name === axisPropName(component, axis));
+    const axisDefault = resolveAxisDefault(values, values, recManifest.defaults?.[axis]);
+    for (const value of values) {
+      const kv = kebab4(value);
+      let fragment = null;
+      if (owner?.kind === "union" && (owner.values ?? []).includes(kv)) {
+        fragment = owner.default === kv ? "" : ` ${owner.name}="${kv}"`;
+      } else if (owner?.kind === "boolean") {
+        fragment = ["true", "on", "yes"].includes(kv) ? ` ${owner.name}` : "";
+      } else if (api.forcedStates.includes(kv)) {
+        fragment = ` data-tendril-state="${kv}"`;
+      } else if (boolProps.some((p) => p.name === kv || kebab4(p.name) === kv)) {
+        fragment = ` ${boolProps.find((p) => p.name === kv || kebab4(p.name) === kv).name}`;
+      } else if (value === axisDefault) {
+        fragment = "";
+      } else if (api.unmappedInteractionEvidence.some((e) => kebab4(e) === kv || kebab4(e) === kebab4(`${axis} ${value}`))) {
+        pixelOnly.push(`${axis}=${value}`);
+        fragment = "";
+      }
+      if (fragment === null) {
+        fail(opts, ExitCode.InputValidation, {
+          error: `axis "${axis}" value "${value}" maps to nothing in the authored API \u2014 an unmapped value silently breaks the Dev Mode snippet`,
+          code: "codeconnect-unmapped-value",
+          remediation: "Record the missing pose (the full matrix is the default plan) so the authored API covers the full lattice, then re-emit."
+        });
+      }
+      entries.push(`${q(value)}: ${q(fragment)}`);
+    }
+    axisLines.push(`const ${varName} = instance.getEnum(${q(axis)}, { ${entries.join(", ")} })`);
+    fragmentVars.push(varName);
+  }
+  const entryRel = path32.relative(callerCwd, path32.join(bundleDir, manifest.entry));
+  const trust = manifest.trustStatement.split("\n")[0] ?? "";
+  const lines = [
+    `// url=${opts.figmaUrl}`,
+    `// source=${entryRel}`,
+    `// component=${component}`,
+    "// Generated by Tendril. Claims below are the bundle's self-reported verification \u2014 recompute them free and offline with: tendril verify",
+    `// ${trust}`,
+    ...pixelOnly.length > 0 ? [`// PIXEL-VERIFIED ONLY (no operable mapping): ${pixelOnly.join(", ")}`] : [],
+    `import figma from 'figma'`,
+    ``,
+    `const instance = figma.selectedInstance`,
+    ...axisLines,
+    ``,
+    `export default {`,
+    `  example: figma.code\`<${component}${fragmentVars.map((v) => `\${${v}}`).join("")} />\`,`,
+    `  imports: [${q(`import { ${component} } from "./${manifest.entry.replace(/\.tsx?$/, "")}" /* adjust to your project import path */`)}],`,
+    `  metadata: { nestable: true },`,
+    `}`,
+    ``
+  ].join("\n");
+  const outFile = path32.resolve(callerCwd, opts.out ?? path32.join(bundleDir, `${component}.figma.ts`));
+  writeFileSync12(outFile, lines);
+  emitData(
+    opts,
+    {
+      file: outFile,
+      component,
+      axes: Object.keys(axisDomains),
+      ...pixelOnly.length > 0 ? { pixelOnly } : {},
+      publish: {
+        cli: `npx @figma/code-connect connect publish --file ${outFile} (requires a Figma Organization/Enterprise plan and a token with Code Connect Write scope)`,
+        note: "Publishing is YOUR action with YOUR Figma access \u2014 Tendril never publishes to Figma."
+      }
+    },
+    () => {
+      process.stdout.write(`code connect template: ${outFile}
+`);
+      if (pixelOnly.length > 0) warn(opts, `pixel-only poses mapped to the base pose in snippets: ${pixelOnly.join(", ")}`);
+      process.stdout.write(`publish (your Figma token, Org/Enterprise plan): npx @figma/code-connect connect publish
+`);
+    }
+  );
+}
+var kebab4, q;
+var init_codeconnect = __esm({
+  "packages/cli/src/commands/codeconnect.ts"() {
+    "use strict";
+    init_src3();
+    init_src7();
+    init_src();
+    init_src6();
+    init_output();
+    kebab4 = (s) => s.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
+    q = (s) => `'${s.replace(/\\/g, "\\\\").replace(/'/g, "\\'").replace(/\n/g, "\\n").replace(/\r/g, "\\r").replace(/\u2028/g, "\\u2028").replace(/\u2029/g, "\\u2029")}'`;
+  }
+});
+
 // packages/cli/src/commands/generate-route.ts
 var generate_route_exports = {};
 __export(generate_route_exports, {
@@ -8620,17 +8947,17 @@ __export(generate_recorded_exports, {
   runGenerateRecorded: () => runGenerateRecorded
 });
 import { confirm as confirm3, isCancel as isCancel3 } from "@clack/prompts";
-import { existsSync as existsSync26 } from "node:fs";
-import path32 from "node:path";
+import { existsSync as existsSync27, readFileSync as readFileSync24 } from "node:fs";
+import path33 from "node:path";
 async function runGenerateRecorded(opts) {
   const callerCwd = process.env["INIT_CWD"] ?? process.cwd();
-  const outDirAbs = path32.resolve(callerCwd, opts.out);
-  const recordedAsPath = path32.resolve(callerCwd, opts.recorded);
+  const outDirAbs = path33.resolve(callerCwd, opts.out);
+  const recordedAsPath = path33.resolve(callerCwd, opts.recorded);
   let task;
   let taskName;
   let authoredApi;
   let composition;
-  const isSet = existsSync26(path32.join(recordedAsPath, "recording-set.json"));
+  const isSet = existsSync27(path33.join(recordedAsPath, "recording-set.json"));
   const registry = TASKS[opts.recorded];
   if (registry !== void 0 && !isSet) {
     task = registry;
@@ -8639,7 +8966,7 @@ async function runGenerateRecorded(opts) {
     try {
       const authored = authorTaskFromSet(recordedAsPath);
       task = authored.task;
-      taskName = path32.basename(recordedAsPath);
+      taskName = path33.basename(recordedAsPath);
       authoredApi = authored.api;
       const roles = RolesSchema.safeParse(loadManifest(recordedAsPath).roles);
       if (roles.success) composition = roles.data;
@@ -8666,7 +8993,7 @@ async function runGenerateRecorded(opts) {
     });
   }
   const missing = task.configs.filter(
-    (c) => !existsSync26(path32.join(task.set, c.rep, "get_screenshot.json")) || !existsSync26(path32.join(task.set, c.rep, "get_metadata.json")) || !existsSync26(path32.join(task.set, c.rep, "get_design_context.json"))
+    (c) => !existsSync27(path33.join(task.set, c.rep, "get_screenshot.json")) || !existsSync27(path33.join(task.set, c.rep, "get_metadata.json")) || !existsSync27(path33.join(task.set, c.rep, "get_design_context.json"))
   );
   if (missing.length > 0) {
     fail(opts, ExitCode.RecordingIncomplete, {
@@ -8736,8 +9063,8 @@ async function runGenerateRecorded(opts) {
 ` : `${line}
 `);
   if (opts.dryRun) {
-    emitData(opts, { dryRun: true, task: taskName, model: modelId, consent, wouldWrite: path32.join(outDirAbs, taskName) }, () => {
-      process.stdout.write(`dry-run: nothing sent, nothing written (would write ${path32.join(outDirAbs, taskName)})
+    emitData(opts, { dryRun: true, task: taskName, model: modelId, consent, wouldWrite: path33.join(outDirAbs, taskName) }, () => {
+      process.stdout.write(`dry-run: nothing sent, nothing written (would write ${path33.join(outDirAbs, taskName)})
 `);
     });
     return;
@@ -8760,7 +9087,21 @@ async function runGenerateRecorded(opts) {
       });
     }
   }
-  const bundleDir = path32.join(outDirAbs, taskName);
+  const bundleDir = path33.join(outDirAbs, taskName);
+  if (existsSync27(path33.join(bundleDir, "component.json"))) {
+    try {
+      const prior = readBundleManifest(readFileSync24(path33.join(bundleDir, "component.json"), "utf8")).manifest;
+      if (prior !== void 0 && prior.provenance.recordingSet.hash !== recordingSetHash(task.set, task.configs)) {
+        fail(opts, ExitCode.InputValidation, {
+          error: `${bundleDir} already holds a bundle bound to recording set "${prior.provenance.recordingSet.path}" \u2014 generating here against a different set would silently rewrite its verification identity`,
+          code: "set-rebind-refused",
+          remediation: "Point --out at a fresh directory, or delete the stale bundle deliberately."
+        });
+      }
+    } catch (err) {
+      if (err.code === void 0) throw err;
+    }
+  }
   const result = await runEngineLoop({
     engine,
     segments,
@@ -9858,7 +10199,7 @@ function buildProgram() {
     await runDoctor({ ...flags, mcpUrl: local["mcpUrl"] });
   });
   const record = program.command("record").description("Agent-driven recording protocol: plan the queue, get instructions, ingest verbatim envelopes, resume from disk.");
-  record.command("plan").requiredOption("--set <dir>", "recording set directory").requiredOption("--component <name>", "component/system name").requiredOption("--metadata <file...>", "verbatim get_metadata envelope(s), optionally <file>@<frameId>").option("--default <axis=value...>", "explicit axis default, e.g. --default State=Rest (repeatable; persisted to the manifest; may re-plan an unrecorded set)").option("--component-set <name>", "when the metadata holds several component sets, record only this one (name = the set label in the plan error)").action(async (_o, cmd) => {
+  record.command("plan").requiredOption("--set <dir>", "recording set directory").requiredOption("--component <name>", "component/system name").requiredOption("--metadata <file...>", "verbatim get_metadata envelope(s), optionally <file>@<frameId>").option("--default <axis=value...>", "explicit axis default, e.g. --default State=Rest (repeatable; persisted to the manifest; may re-plan an unrecorded set)").option("--component-set <name>", "when the metadata holds several component sets, record only this one (name = the set label in the plan error)").option("--sample", "cost sampling: anchor + one-factor + conflict crosses only (the FULL variant matrix is the default; sampling is blind to multi-axis interactions)").action(async (_o, cmd) => {
     const flags = globalFlags(cmd.parent.parent);
     const local = cmd.opts();
     const { runRecordPlan: runRecordPlan2 } = await Promise.resolve().then(() => (init_record(), record_exports));
@@ -9867,6 +10208,7 @@ function buildProgram() {
       setDir: local["set"],
       component: local["component"],
       metadataFiles: local["metadata"],
+      sample: local["sample"],
       ...local["default"] !== void 0 ? { defaultSpecs: local["default"] } : {},
       ...local["componentSet"] !== void 0 ? { componentSet: local["componentSet"] } : {}
     });
@@ -9957,7 +10299,7 @@ function buildProgram() {
       ...local["model"] !== void 0 ? { model: local["model"] } : {}
     });
   });
-  engine.command("score").argument("<taskOrSet>", "reference task name or recording-set directory").argument("<candidateDir>", "directory containing the proposed bundle files").option("--bar <bar>", "target bar: pass (0.95) or cert (0.97)", "pass").option("--host <name>", "self-reported host identity (recorded in provenance, labeled self-reported)").requiredOption("--model <id>", "proposer model, self-reported \u2014 required; a score without a declared model is not accepted").action(async (taskOrSet, candidateDir, _o, cmd) => {
+  engine.command("score").argument("<taskOrSet>", "reference task name or recording-set directory").argument("<candidateDir>", "directory containing the proposed bundle files").option("--bar <bar>", "target bar: pass (0.95) or cert (0.97)", "pass").option("--host <name>", "self-reported host identity (recorded in provenance, labeled self-reported)").requiredOption("--model <id>", "proposer model, self-reported \u2014 required; a score without a declared model is not accepted").option("--rebind", "explicitly re-bind an already-bound bundle to a different recording set (refused otherwise \u2014 rebinding rewrites the bundle's verification identity)").action(async (taskOrSet, candidateDir, _o, cmd) => {
     const flags = globalFlags(cmd.parent.parent);
     const local = cmd.opts();
     const { runEngineScore: runEngineScore2 } = await Promise.resolve().then(() => (init_engine2(), engine_exports));
@@ -9967,7 +10309,20 @@ function buildProgram() {
       candidateDir,
       bar: local["bar"] === "cert" ? "cert" : "pass",
       ...local["host"] !== void 0 ? { host: local["host"] } : {},
-      model: local["model"]
+      model: local["model"],
+      rebind: local["rebind"]
+    });
+  });
+  program.command("codeconnect").description("Emit a Figma Code Connect template (.figma.ts) for a certified bundle \u2014 every variant\u2192prop mapping from recorded truth, stamped with the trust statement. Publishing stays yours (figma connect publish; Org/Enterprise plan).").argument("<bundleDir>", "bundle directory (must carry component.json)").requiredOption("--figma-url <url>", "figma.com /design/ URL of the COMPONENT SET (Copy link to selection)").option("--set <dir>", "recording set override (default: the bundle's provenance path)").option("--out <file>", "output file (default: <bundle>/<Component>.figma.ts)").action(async (bundleDir, _o, cmd) => {
+    const flags = globalFlags(cmd.parent);
+    const local = cmd.opts();
+    const { runCodeConnect: runCodeConnect2 } = await Promise.resolve().then(() => (init_codeconnect(), codeconnect_exports));
+    runCodeConnect2({
+      ...flags,
+      bundleDir,
+      figmaUrl: local["figmaUrl"],
+      ...local["set"] !== void 0 ? { set: local["set"] } : {},
+      ...local["out"] !== void 0 ? { out: local["out"] } : {}
     });
   });
   program.command("verify").description("Recompute verification for a generated bundle against its recording set (per-config status, behaviors, honest exit codes).").argument("<bundleDir>", "bundle directory to verify").option("--task <name>", "legacy task adapter for bundles WITHOUT component.json (bundle v1 carries its own prop manifest)").option("--set <dir>", "recording set directory (overrides the bundle's provenance path)").option("--bar <bar>", "target bar: pass (0.95) or cert (0.97)", "pass").action(async (bundleDir, _opts, cmd) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tendrilapp/cli",
-  "version": "0.1.6",
+  "version": "0.1.8",
   "description": "Figma design systems → verified React components. CLI ruler + MCP server.",
   "license": "SEE LICENSE IN LICENSE",
   "type": "module",