@ultimat3/ui 20.2.1 → 22.0.0

package/CLAUDE.md

@@ -1,6 +1,6 @@
 # @ultimat3/ui — agent notes
 
-Tier 4 (moved 5 → 4 on 2026-08-19, when the `admin → ui` exception was deleted). Imports `@ultimat3/core`, `i18n`, `money`, `time` — **not `schema`**, which this line claimed until 2026-08-24 and `package.json` never declared. That absence is why `src/form/` re-declares Standard Schema's one member structurally (`FormSchema`) and copies `formatPath` as `formatFieldPath`: the tier table permits the edge, the manifest and the lockfile do not. Never `http`, `action`, `render`, `admin` — `render` is tier 4 too, which is what keeps the static bundle graph out of the design system.
+Tier 4. Imports `@ultimat3/core`, `i18n`, `money`, `time` — **not `schema`**, which `package.json` does not declare: that is why `src/form/` re-declares Standard Schema's one member structurally (`FormSchema`) and copies `formatPath` as `formatFieldPath`. Never `http`, `action`, `render`, `admin` — `render` is tier 4 too, which keeps the static bundle graph out of the design system.
 
 ## Boundary
 
@@ -14,17 +14,12 @@ Tier 4 (moved 5 → 4 on 2026-08-19, when the `admin → ui` exception was delet
 - **No raw colours.** Only `t.role('<role>')` / `var(--color-*)`. Canonical roles live in `src/tokens/_colors.scss`; `tokens.ts` mirrors them and `tokens.test.ts` fails on drift.
 - **Logical properties only.** `margin-inline`, `inset-inline-start`, `text-align: start`. A `left`/`right` in a stylesheet is a bug.
 - **solid-js is a type-only import.** All reactive access goes through `src/theme/solid-adapter.ts`. Never `import { createSignal } from 'solid-js'`.
-- **The runtime SLOT is `src/theme/runtime-slot.ts`; the RULE is `solid-adapter.ts`, and the split is a byte measurement.** `solid()` throws `runtimeMissingError`, so it imports `../errors`, which bare-imports `error-registry.ts` — the `registerErrorCodes()` call `package.json` declares side-effectful and no bundler may shake — so while the slot sat beside it, an island whose `mount` did nothing but `setSolidRuntime(solidRuntime)` carried @ultimat3/core's whole error registry: **5,719 B against 72 B**. One module owns `let runtime`, `solid()` reads it through `registeredSolidRuntime()`, and `barrel-bytes.test.ts` holds the ceiling at 1 kB — small enough that the registry re-entering the graph reds it.
-- **The barrel is the ONE import path, and component subpath exports are refused on measurement** (2026-08-23, issue #275). `import { Button } from '@ultimat3/ui'` and a deep path into `components/Button` emit the same chunk — the same MODULES, and the same bytes to the character once the bundler's own banner comments are out; so do `useUi` (14 kB) and `moneyText` (25 kB). `@ultimat3/ui/button` would be a second idiom for zero bytes. The two subpaths that exist are not exceptions to that: `./icons/*` is 1,767 data modules no bundler can split, and `./jsx-probe` is test-only and deliberately absent from the barrel. `barrel-bytes.test.ts` compares the two paths, so the day the barrel stops shaking this argument reds instead of ageing. **Not "to within the length of the entry's own module name"**, which this line said until 2026-08-25 and no build agrees with: measured, an entry file name 29 characters longer produced a chunk of identical size, and the only difference between the two minified chunks was the minifier's identifier allocation — one byte. What DOES differ, from one build to the next and with no source change at all, is whether Bun 1.4.0's shaker dropped `@ultimat3/core`'s `schema-error-codes.ts` (1,116 B, load-correlated, issues #273 #276); the test names that module rather than allowing bytes for it.
-- **`useUi()`'s server branch is a SLOT, and the module that fills it is browser-mapped** (2026-09-19, issue #490). `context.ts` is what every component's `useUi()` retains, and it imports NO value from `@ultimat3/i18n` or `@ultimat3/time`: the i18n barrel installs the framework catalog at import, so one `createTranslator`/`currentLocale` there was 16.1 kB of catalog, time and core's logger in every island with a `UiProvider` — for a branch a DOM never takes. The request readers live in `src/theme/ambient.ts`, which registers `ambientUiContext` into `src/theme/ambient-slot.ts` at import; `index.ts` imports it BARE, above every re-export, and `package.json`'s `browser` field maps that file to `ambient.browser.ts` for a browser bundler (measured on Bun 1.4.0 and 1.4.2, symlinked or not — and never at runtime, so `bun test` and SSR always get the server's). `directionOf` is `@ultimat3/core`'s for the same reason, and `fallbackTranslator` is written here with `context.test.ts` holding it member-for-member against `createTranslator({})`. The cost of the shape: a test that reaches components by module path and exercises the inert server path must `import './ambient'` itself, as `inert-render.test.ts` does — the barrel is what registers. `errors.ts` is pure now too: the `registerErrorCodes()` call is `src/error-registry.ts`, imported bare from `errors.ts`, so a bundler honouring `sideEffects` (Bun 1.4.2; 1.4.0 ignored the array, oven-sh/bun#40650) drops the registry from a chunk that reaches `errors.ts` only through the barrel — the setter island was 10,928 B on 1.4.2 before, 72 B over the floor after. `barrel-bytes.test.ts` pins the island's retained-module list: no `i18n`, `time` or `money` path, no `ambient.ts`, and nothing of this package outside a named list.
+- **The runtime SLOT is `src/theme/runtime-slot.ts`; the RULE is `solid-adapter.ts`, and the split is a byte measurement.** `solid-adapter.ts` reaches `../errors` and so core's error registry; the slot imports nothing, so an island that only calls `setSolidRuntime` pays 72 B, not 5,719. `barrel-bytes.test.ts` holds the ceiling at 1 kB.
+- **The barrel is the ONE import path; component subpath exports are refused on measurement** (issue #275). A barrel import and a deep path emit the same modules and bytes, so `@ultimat3/ui/button` would be a second idiom for zero bytes. The two subpaths that exist are not exceptions: `./icons/*` is 1,767 data modules no bundler can split, and `./jsx-probe` is test-only. `barrel-bytes.test.ts` compares the two paths and names `schema-error-codes.ts` (Bun 1.4.0's load-correlated shake, issues #273 #276) rather than allowing bytes for it.
+- **`useUi()`'s server branch is a SLOT, and the module that fills it is browser-mapped** (issue #490). `context.ts` imports no value from `@ultimat3/i18n` or `@ultimat3/time` (the i18n barrel installs the framework catalog at import: 16.1 kB per island). `src/theme/ambient.ts` registers `ambientUiContext` into `ambient-slot.ts` at import; `index.ts` imports it BARE above every re-export, and `package.json`'s `browser` field maps it to `ambient.browser.ts` (bundlers only — `bun test` and SSR get the server's). A test reaching components by module path must `import './ambient'` itself, as `inert-render.test.ts` does. `fallbackTranslator` is held member-for-member against `createTranslator({})` by `context.test.ts`. `errors.ts` is pure: `registerErrorCodes()` is `src/error-registry.ts`, imported bare. `barrel-bytes.test.ts` pins the theme island's retained-module list.
 - **`solid()` always answers off-DOM.** No registered runtime and no DOM is a *server render*, and it gets `INERT_SOLID_RUNTIME` (`src/theme/inert-runtime.ts`) — signals hold, memos recompute on read, effects never run, `useContext` returns the default. No DOM means no reactivity to lose; a **DOM** with no runtime is still `X_UI_RUNTIME_MISSING`, because that one is the theme toggle that does nothing. Never widen this to "no runtime, never throw": that is the silent degradation the split exists to prevent.
-- **`useUi()` reads the request on the server**, via `ambientUiContext()` — `currentLocale()`, `currentTimeZone()`, `useI18n()`. Those two read **core's own `Ctx.locale` / `Ctx.tz`**, which `@ultimat3/http`'s `locale` stage writes once per request; `@ultimat3/i18n` and `@ultimat3/time` publish no field of their own. Never add a second ambient store here or there — `time` kept a `ctx['timeZone']` nothing wrote until 2026-08, and the whole cost was invisible: every server-rendered date formatted in UTC under a doc comment saying it did not. `theme`/`currency` deliberately have no ambient source at all.
-- **Every locale-sensitive call takes the locale as an ARGUMENT, `toLocaleUpperCase` included.**
-  `initialsOf(name, locale)` reads `useUi().locale`, exactly as `DateTime` does. A bare
-  `toLocaleUpperCase()` reads the RUNTIME's default — a server's `LANG`, a browser's UI language —
-  which is the ambient locale this package does not have; Turkish is where the absence shows,
-  because dotted `i` uppercases to `İ`, so a Turkish member's avatar read `I` on a server in
-  Ireland. **Breaking**: `initialsOf`'s second parameter is required.
+- **`useUi()` reads the request on the server**, via `ambientUiContext()` — `currentLocale()`, `currentTimeZone()`, `useI18n()`, which read **core's own `Ctx.locale` / `Ctx.tz`** (written once per request by `@ultimat3/http`'s `locale` stage). Never add a second ambient store here or in `i18n`/`time`. `theme`/`currency` have no ambient source at all.
+- **Every locale-sensitive call takes the locale as an ARGUMENT, `toLocaleUpperCase` included.** `initialsOf(name, locale)` reads `useUi().locale`; a bare `toLocaleUpperCase()` reads the runtime's default (Turkish dotted `i` → `İ`).
 - **`UiProvider` is client-only and throws on the server** (`providerNeedsRuntimeError`, the same `X_UI_RUNTIME_MISSING`). A Provider in an inert tree reaches no descendant — the tree is built before the renderer walks it, so consumers are walked outside every owner and read the context default even with a real Solid runtime registered. Rendering the children anyway would drop its locale, zone, currency and translator silently. Making it work needs the *renderer* to scope a context around the walk; until then it refuses.
 - **A component may call `solid()` freely.** Its effects must stay DOM-only work — they simply never run on the server.
 - **No `{...rest}` prop spreading.** Splitting props reactively needs solid's `splitProps` (a value import), so components declare explicit props and read `props.x` inside JSX.
@@ -35,7 +30,7 @@ Tier 4 (moved 5 → 4 on 2026-08-19, when the `admin → ui` exception was delet
 - **Icons are generated, never authored.** `src/icons/glyphs/*.ts` is one module per Lucide icon, written by `bun run icons` from `lucide-static@LUCIDE_VERSION`. Never hand-edit a glyph, never add a hand-drawn one, never introduce a second icon source. An upstream fix is a version bump plus a re-run. `lucide` itself is NOT a dependency — the data is committed, so the package still installs, typechecks and renders offline with zero runtime deps.
 - **One icon, one module.** The `Icon` component takes a `glyph`, not a name: a `name → glyph` map would be one module holding 1767 icons, and no bundler can split that. Per-icon imports are the whole point (1 icon = 104 B minified, 50 = 8.9 kB).
 - **No client runtime exists yet.** A new interactive component must be correct server-rendered and usable with scripting off — `<details>` for disclosure, `<input list>`+`<datalist>` for suggestions, a real `rel="next"` link for paging — with listeners and observers as additive extras. A component that renders nothing until JS runs does not ship.
-- **`inert-render.test.ts` must not assume which factory its `.tsx` compiled to.** `@ultimat3/render`'s `index.ts` installs a process-global `Bun.plugin` `onLoad` for `/\.tsx$/` at import, and `bun test` is one process — so any file in the run that imports render first makes every ui component after it compile to render's `h` instead of the file's own inert copy. The walker recognises both (`Symbol.for('ultimate.render.jsx')`, off the global registry, never an import), and the first test in the describe asserts a component returned a node it recognises. Without both halves the file silently rendered `"[object Object]"` and 26 assertions were decided by shard packing.
+- **`inert-render.test.ts` must not assume which factory its `.tsx` compiled to.** `@ultimat3/render` installs a process-global `.tsx` `onLoad` plugin at import, so in one `bun test` process a component may compile to render's `h`. The walker recognises both (`Symbol.for('ultimate.render.jsx')`), and the first test asserts a recognised node — otherwise the file renders `"[object Object]"` and passes by shard packing.
 - **Components are not unit-tested through a renderer.** `.tsx` compiles to `@ultimat3/render`'s `h`, which this package may not import, so every rule lives in a pure module beside the component (`icon-glyph.ts`, `accordion-view.ts`, `combobox-filter.ts`, `infinite-scroll-view.ts`) and *that* is what the tests assert.
 - Formatting logic lives in a pure `*-view.ts` next to the component (`money-view.ts`, `date-time-view.ts`) so it is testable with no renderer. Every other renderer-free core follows the same rule under its own name (`sort-state.ts`, `image-source.ts`) — the `.tsx` holds markup, never a rule.
 - **The rule being pure is not enough — the WIRING has to be tested too.** `createRovingTabindex` was correct and `Menu` handed it `[role="menuitem"]`, so a disabled item made every item after it unreachable and every assertion in the package still passed. `src/jsx-probe.ts` reads the props an element actually carries (a `tabindex`, an `aria-live`, an `onKeyDown`, a `ref`) and `src/fake-dom.ts` gives it a DOM where a disabled control REFUSES focus, exactly as the real one does. Both are test-only and neither is in `index.ts`. `jsx-probe`'s `probe`/`unprobe` are the one exception, reachable at the subpath `@ultimat3/ui/jsx-probe` and still absent from the barrel: `globalThis.React` is ONE property, so its install/restore counter has to be ONE counter — `@ultimat3/admin` (tier 5) kept a second pair, and interleaved installs restored the two harnesses in the wrong order, leaving the global holding a harness the run had already torn down. `components/interaction.test.ts` is where a keyboard or form-participation claim gets proven; asserting the pure helper alone is how these shipped.
@@ -45,7 +40,8 @@ Tier 4 (moved 5 → 4 on 2026-08-19, when the `admin → ui` exception was delet
   (`src/components/async-branch.ts`) is the ONLY place the `(pending, failed, empty, data)` decision
   is made — `AsyncRegion` renders it and `DataTable` calls it, so a table and a card list cannot
   disagree about what "loading with stale rows" looks like. The property is structural: an
-  `AsyncState` in `pending` carries no data, so nothing can be found empty in it, and "No results"
+  `AsyncState` (declared in `@ultimat3/core` since 21.0.0 — imported here, never re-exported, so
+  it has one import path) in `pending` carries no data, so nothing can be found empty in it, and "No results"
   for one frame before the first page arrives is unconstructible rather than discouraged.
   `<AsyncRegion>`'s `empty` and `ready` are REQUIRED props, so forgetting the empty state is a type
   error. `refreshing` CARRIES the previous data — a refetch dims what is on screen (`aria-busy`) and
@@ -93,8 +89,8 @@ Tier 4 (moved 5 → 4 on 2026-08-19, when the `admin → ui` exception was delet
 - **An issue that matches no declared field is SURFACED, never swallowed.** It goes to `formErrors`, which `<Form error>` announces and focuses; a near miss (`items` against a form holding `items[0].price`) goes there too, because an error rendered against the wrong input is a lie the user acts on. Two issues on one field both survive in the state — `Field`'s one slot renders the first, `messagesFor` has the rest.
 - **The framework ships the mapping and no copy table.** `FormIssue.message` is a schema's diagnostic text and is never user-facing; `messageFor` is required and is the app's. There is deliberately no `ui.form.*` key: a built-in wording would be one app's convention shipped to every other. A `messageFor` that answers `''` or throws falls back to the diagnostic text — the loud-but-safe answer `t()` already gives with `⟦key⟧`, because the alternatives are a control marked `aria-invalid` with nothing to read, or a submit abandoned mid-flight holding the user's input.
 - **The wire carries no structured issue list, `As of 2026-08-24`.** `InputInvalidError` renders the issues into `cause` and puts nothing in `meta`, and `toProblem` has no `issues` member, so `issuesFromRejection` reads `meta.issues` where there is one and parses the cause line where there is not. It binds a fragment to a field only when the fragment's head is a DECLARED path, so a mis-split degrades to a form-level error rather than to a wrong control. Delete the line parser the day the wire carries the list.
-- **Generated source is a CODE sink.** `build-icons.ts` writes modules every app EXECUTES at import, from data fetched over the network, so an attribute value goes through `JSON.stringify` and never `'${value}'` — and `SAFE_ATTR_VALUE` refuses anything that is not glyph geometry one layer earlier. `iconElements` guards tags and attribute NAMES; it has never guarded a value. Malformed upstream data is `X_UI_INVALID_VALUE`; only the generator's real environment faults (no network, no biome binary) are `X_UI_RUNTIME_MISSING`.
-- **The icon NAME is the third sink, and it has no escape.** The upstream map key becomes a filesystem path under `GLYPHS_DIR`, an exported identifier and a `//` banner, and `buildIcons` clears `GLYPHS_DIR` before it writes — so `../../index` was a delete of the glyph tree followed by an overwrite of a hand-written module, and a key carrying `;` produced a module that typechecked and ran. `SAFE_ICON_NAME` (`/^[a-z0-9]+(-[a-z0-9]+)*$/`) is checked in `parseIconNodes` BEFORE `out.set`, the same allowlist-over-a-sink shape as `SAFE_ATTR_VALUE` one layer down; all 1767 committed names pass it and `build-icons.test.ts` asserts that.
+- **Generated source is a CODE sink.** `build-icons.ts` writes modules every app executes, from network data: attribute values go through `JSON.stringify`, and `SAFE_ATTR_VALUE` refuses anything that is not glyph geometry. Malformed upstream data is `X_UI_INVALID_VALUE`; only real environment faults (no network, no biome) are `X_UI_RUNTIME_MISSING`.
+- **The icon NAME is the third sink, and it has no escape.** It becomes a path under `GLYPHS_DIR` (which `buildIcons` clears), an identifier and a banner, so `SAFE_ICON_NAME` (`/^[a-z0-9]+(-[a-z0-9]+)*$/`) is checked in `parseIconNodes` before `out.set`; `build-icons.test.ts` asserts all 1767 committed names pass.
 
 ## Files
 
@@ -154,3 +150,5 @@ bun run --filter @ultimat3/ui icons       # regenerate the glyph set (network; d
 `tsconfig` that maps `@ultimat3/*` to `packages/*/src` needs the more specific entry
 `"@ultimat3/ui/icons/*": ["./packages/ui/src/icons/glyphs/*"]` for TypeScript to follow it —
 runtime resolution is the `exports` map either way.
+
+Why each rule above is shaped the way it is: [`docs/history/ui.md`](../../docs/history/ui.md).

package/README.md

@@ -545,6 +545,15 @@ of truth for the one thing the server decides.
 | `X_UI_QR_CAPACITY` | a `<QrCode>` value over version 3's 42-byte ceiling (byte mode, error-correction level M). The encoder draws versions 1–3 only; the cause names the byte count and the ceiling |
 | `X_UI_INVALID_VALUE` | `<Money>` given a float, `<DateTime>` given an unparseable instant, `<Image>` given mixed `w`/`x` descriptors or one dimension without the other, a heading level off 1–6, a `defineTheme()` value that is not a token value, an `<Icon>` glyph with a tag/attribute/colour outside `ICON_TAGS`, two `Accordion` items sharing an id, `InfiniteScroll` with `hasMore` and no `nextHref`, a negative `debounce` window, or (`As of 2026-08`) upstream icon data `bun run icons` refuses (not an object, no renderable nodes, an attribute value that is not glyph geometry) |
 
+### Error classes
+
+Every error class `src/index.ts` exports, for `instanceof` inside one process. Across a wire or
+a job boundary the class is gone and the `code` is what survives — match on that.
+
+| Class | Code | Declared in |
+|---|---|---|
+| `UiError` | any `UiErrorCode` — `UI_ERROR_CODES` | `src/errors.ts` |
+
 ## Commands
 
 ```

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ultimat3/ui",
-  "version": "20.2.1",
+  "version": "22.0.0",
   "description": "SolidJS design system: semantic design tokens, dark/RTL-ready SCSS modules, a11y primitives",
   "license": "MIT",
   "type": "module",
@@ -48,10 +48,10 @@
     "icons": "bun run src/icons/build-icons.ts"
   },
   "dependencies": {
-    "@ultimat3/core": "20.2.1",
-    "@ultimat3/i18n": "20.2.1",
-    "@ultimat3/money": "20.2.1",
-    "@ultimat3/time": "20.2.1"
+    "@ultimat3/core": "22.0.0",
+    "@ultimat3/i18n": "22.0.0",
+    "@ultimat3/money": "22.0.0",
+    "@ultimat3/time": "22.0.0"
   },
   "peerDependencies": {
     "solid-js": "^1.9.0"

package/src/components/AsyncRegion.tsx

@@ -7,14 +7,13 @@
 // placeholder is derived from `reserve` so it cannot mismatch the loaded box, and the failure
 // renders through `ErrorState`, which is the one thing allowed to phrase an error.
 
-import { finiteCount } from '@ultimat3/core';
+import { type AsyncState, finiteCount } from '@ultimat3/core';
 import type { JSX } from 'solid-js';
 import { ariaBool } from '../a11y';
 import { cx } from '../cx';
 import styles from './AsyncRegion.module.scss';
 import {
   type AsyncBranch,
-  type AsyncState,
   asyncBranch,
   isBusyBranch,
   type ReserveBox,

package/src/components/CopyButton.tsx

@@ -12,6 +12,7 @@ import { iconCopy } from '../icons/glyphs/copy';
 import { useUi } from '../theme/context';
 import { solid } from '../theme/solid-adapter';
 import styles from './CopyButton.module.scss';
+import { writeToClipboard } from './copy-write';
 import { Icon } from './Icon';
 import type { Size } from './variants';
 
@@ -36,12 +37,20 @@ export function CopyButton(props: CopyButtonProps): JSX.Element {
   const label = (): string => props.label ?? ui.t(UI_KEYS.copy);
   const copiedLabel = (): string => props.copiedLabel ?? ui.t(UI_KEYS.copied);
 
+  let reset: ReturnType<typeof setTimeout> | undefined;
+  // The "copied" timer does not outlive the button: firing a setter on an unmounted component is
+  // a write into a disposed owner.
+  rt.onCleanup(() => clearTimeout(reset));
+
   const onClick = async (): Promise<void> => {
-    // Optional chaining on both: a harness has a `navigator` with no `clipboard`, and `announce`
-    // needs a document that can find its live region.
-    await navigator.clipboard?.writeText(props.value);
+    const clipboard = typeof navigator === 'undefined' ? undefined : navigator.clipboard;
+    // "Copied" only on a write that RESOLVED: no clipboard used to show the check mark anyway, and
+    // a refused write escaped as an unhandled rejection through the `void` below.
+    if (!(await writeToClipboard(props.value, clipboard))) return;
     setCopied(true);
-    setTimeout(() => setCopied(false), COPIED_MS);
+    clearTimeout(reset);
+    reset = setTimeout(() => setCopied(false), COPIED_MS);
+    // `announce` needs a document that can find its live region.
     if (typeof document !== 'undefined' && typeof document.getElementById === 'function') {
       announce(copiedLabel());
     }

package/src/components/DataTable.tsx

@@ -6,13 +6,13 @@
 // table and a card list cannot disagree about what "loading with stale rows" looks like. Only the
 // PLACEHOLDER is local, because a table's is table-shaped: rows of cells, not lines of text.
 
-import { finiteCount } from '@ultimat3/core';
+import { type AsyncState, finiteCount } from '@ultimat3/core';
 import type { JSX } from 'solid-js';
 import { ariaBool } from '../a11y';
 import { cx } from '../cx';
 import { UI_KEYS } from '../i18n-keys';
 import { useUi } from '../theme/context';
-import { type AsyncBranch, type AsyncState, asyncBranch, isBusyBranch } from './async-branch';
+import { type AsyncBranch, asyncBranch, isBusyBranch } from './async-branch';
 import styles from './DataTable.module.scss';
 import { EmptyState } from './EmptyState';
 import { ErrorState } from './ErrorState';

package/src/components/Dialog.tsx

@@ -30,6 +30,9 @@ export function Dialog(props: DialogProps): JSX.Element {
   const rt = solid();
   const titleId = useId('dialog-title');
   let element: HTMLDialogElement | undefined;
+  // Where the press STARTED. A drag-select begun in the panel and released over the backdrop
+  // fires `click` on the <dialog> itself, and closed the dialog mid-selection.
+  let pressedBackdrop = false;
 
   rt.createEffect(() => {
     const dialog = element;
@@ -52,9 +55,15 @@ export function Dialog(props: DialogProps): JSX.Element {
         event.preventDefault();
         props.onClose();
       }}
+      onPointerDown={(event) => {
+        pressedBackdrop = event.target === element;
+      }}
       onClick={(event) => {
-        // A click on the backdrop lands on the <dialog> itself, never a child.
-        if (props.dismissOnBackdrop !== false && event.target === element) props.onClose();
+        // A click on the backdrop lands on the <dialog> itself, never a child — and so must the
+        // press that began it, or this is the end of a drag that started in the panel.
+        const dismiss = pressedBackdrop && event.target === element;
+        pressedBackdrop = false;
+        if (props.dismissOnBackdrop !== false && dismiss) props.onClose();
       }}
     >
       <div class={styles['panel']}>

package/src/components/Drawer.tsx

@@ -30,6 +30,9 @@ export function Drawer(props: DrawerProps): JSX.Element {
   const rt = solid();
   const titleId = useId('drawer-title');
   let element: HTMLDialogElement | undefined;
+  // Where the press STARTED — the `Dialog` rule: a drag-select begun in the panel and released
+  // over the backdrop fires `click` on the <dialog> itself, and closed the drawer mid-selection.
+  let pressedBackdrop = false;
 
   rt.createEffect(() => {
     const dialog = element;
@@ -53,8 +56,13 @@ export function Drawer(props: DrawerProps): JSX.Element {
         event.preventDefault();
         props.onClose();
       }}
+      onPointerDown={(event) => {
+        pressedBackdrop = event.target === element;
+      }}
       onClick={(event) => {
-        if (event.target === element) props.onClose();
+        const dismiss = pressedBackdrop && event.target === element;
+        pressedBackdrop = false;
+        if (dismiss) props.onClose();
       }}
     >
       <div class={styles['panel']}>

package/src/components/InfiniteScroll.tsx

@@ -10,6 +10,7 @@ import { useUi } from '../theme/context';
 import { solid } from '../theme/solid-adapter';
 import styles from './InfiniteScroll.module.scss';
 import { loadMoreState } from './infinite-scroll-view';
+import { createLoadMoreTrigger } from './load-more-trigger';
 import { Spinner } from './Spinner';
 
 /** One viewport-ish of runway, so the next page is usually there before the current one ends. */
@@ -36,6 +37,9 @@ export function InfiniteScroll(props: InfiniteScrollProps): JSX.Element {
   const rt = solid();
   let sentinel: HTMLSpanElement | undefined;
 
+  // Built once per mount; the observer reports into it and so does the `loading` edge below.
+  const trigger = createLoadMoreTrigger(() => props.onLoadMore?.());
+
   rt.createEffect(() => {
     const onLoadMore = props.onLoadMore;
     if (onLoadMore === undefined || sentinel === undefined) return;
@@ -43,7 +47,10 @@ export function InfiniteScroll(props: InfiniteScrollProps): JSX.Element {
     if (!props.hasMore || typeof IntersectionObserver === 'undefined') return;
     const observer = new IntersectionObserver(
       (entries) => {
-        if (props.loading !== true && entries.some((entry) => entry.isIntersecting)) onLoadMore();
+        trigger.seen(
+          entries.some((entry) => entry.isIntersecting),
+          props.loading === true,
+        );
       },
       { rootMargin: props.rootMargin ?? ROOT_MARGIN },
     );
@@ -51,6 +58,13 @@ export function InfiniteScroll(props: InfiniteScrollProps): JSX.Element {
     rt.onCleanup(() => observer.disconnect());
   });
 
+  // A page that loaded without pushing the sentinel out of view gets no new intersection report,
+  // so the loading edge re-asks — the list stalled here with its runway still showing.
+  rt.createEffect(() => {
+    const loading = props.loading === true;
+    if (props.hasMore) trigger.settled(loading);
+  });
+
   const onClick = (event: MouseEvent): void => {
     if (props.onLoadMore === undefined) return;
     event.preventDefault();

package/src/components/async-branch.ts

@@ -4,18 +4,11 @@
 // unreachable until a result has arrived, and a refetch keeps the previous data on screen.
 
 /**
- * What a caller hands an async region. A STATE, never a query: `@ultimat3/ui` is tier 4 and may
- * not import `query`, `action` or `realtime`, so a live-query accessor, a `createResource` and a
- * plain signal all arrive here as the same four shapes.
- *
- * `refreshing` is the one that makes search feel fast — it CARRIES the previous data, so a refetch
- * re-renders what is already on screen instead of tearing it down to a skeleton.
+ * What a caller hands an async region is `AsyncState` from `@ultimat3/core` — declared at tier 0
+ * because realtime's read hooks (tier 3) return it and ui (tier 4) consumes it, and neither may
+ * import the other that way. Imported, never re-exported: one home, one import path.
  */
-export type AsyncState<T> =
-  | { readonly status: 'pending' }
-  | { readonly status: 'refreshing'; readonly data: T }
-  | { readonly status: 'ready'; readonly data: T }
-  | { readonly status: 'failed'; readonly error: unknown };
+import type { AsyncState } from '@ultimat3/core';
 
 /**
  * The branch a region renders. `empty` and `ready` carry `busy`; `pending` and `failed` do not,
@@ -23,8 +16,9 @@ export type AsyncState<T> =
  *
  * There is no `{ kind: 'empty' }` reachable from `{ status: 'pending' }` — that is the whole
  * point of this module. "No results" rendered for one frame before the first page arrives is the
- * most common agent-authored UX bug in a list screen, and the union above makes it unconstructible
- * rather than merely discouraged: `pending` holds no data, so nothing can be found empty in it.
+ * most common agent-authored UX bug in a list screen, and `AsyncState`'s union makes it
+ * unconstructible rather than merely discouraged: `pending` holds no data, so nothing can be found
+ * empty in it.
  */
 export type AsyncBranch<T> =
   | { readonly kind: 'pending' }

package/src/components/copy-write.ts

@@ -0,0 +1,22 @@
+// Single responsibility: one clipboard write, answered as a boolean. `CopyButton` claims "Copied"
+// only on `true` — a missing clipboard (an insecure origin, an old browser, a harness) and a
+// refused write (permission) are both a copy that did not happen, and neither may reject.
+
+/** The one method used, structurally — `navigator.clipboard`, or a test's stand-in. */
+export interface ClipboardWriter {
+  writeText(text: string): Promise<void>;
+}
+
+export async function writeToClipboard(
+  value: string,
+  clipboard: ClipboardWriter | undefined,
+): Promise<boolean> {
+  if (clipboard === undefined) return false;
+  try {
+    await clipboard.writeText(value);
+    return true;
+  } catch {
+    // Refused: a permission prompt denied, or a document without focus. The button stays as it was.
+    return false;
+  }
+}

package/src/components/date-time-view.ts

@@ -2,6 +2,7 @@
 // needs: the machine-readable ISO instant for `<time datetime>` and the human
 // string formatted in the injected zone + locale.
 
+import { isIsoDateTime } from '@ultimat3/core';
 import {
   type DateTimeStyle,
   type FormatDateTimeOptions,
@@ -38,17 +39,21 @@ export interface DateTimeView {
   readonly text: string;
 }
 
-/** A date-TIME string with no `Z` and no `±HH:MM`. A date-only string is not one: the spec parses
- * `2026-08-14` as UTC, so it is already zone-independent. */
-const OFFSETLESS_DATETIME = /^\d{4}-\d{2}-\d{2}[T ]\d{2}:\d{2}(?![\s\S]*(?:Z|[+-]\d{2}:?\d{2})$)/;
-
 export function toDate(value: TimeInput): Date {
   // `new Date('2026-08-14T09:00')` resolves in the HOST's zone — the one ambient default this
   // package forbids, inside the one function that had it. It rendered `09:00` on a `TZ=UTC` runner
   // and `00:00` on `TZ=Asia/Tokyo` with the same `timeZone="UTC"` prop and no error. Every
   // FORMATTING path here was already zoned; only the parse was not.
-  if (typeof value === 'string' && OFFSETLESS_DATETIME.test(value)) {
-    throw invalidValueError('DateTime', value, 'an ISO string carrying Z or a ±HH:MM offset');
+  //
+  // The predicate is `@ultimat3/schema`'s — the one `t.date` and `timestamp()` use — so a string is
+  // ISO-8601 in SHAPE as well as zoned: `'August 14, 2026 09:00'` and `'8/14/2026'` were not
+  // "ISO-shaped offset-less" and walked past a narrower local guard into `new Date`, in the host zone.
+  if (typeof value === 'string' && !isIsoDateTime(value)) {
+    throw invalidValueError(
+      'DateTime',
+      value,
+      'an ISO-8601 string: a date (2026-08-14) or a date-time carrying Z or a ±HH:MM offset',
+    );
   }
   const date = value instanceof Date ? value : new Date(value);
   if (Number.isNaN(date.getTime())) {

package/src/components/load-more-trigger.ts

@@ -0,0 +1,25 @@
+// Single responsibility: when an endless list's sentinel asks for the next page. Kept apart from
+// the observer because IntersectionObserver reports only CHANGES — a sentinel that never left the
+// viewport produces no second callback, and the loading edge is the only other signal there is.
+
+export interface LoadMoreTrigger {
+  /** The observer's report: is the sentinel in view, and is a page in flight right now? */
+  seen(visible: boolean, loading: boolean): void;
+  /** `loading` changed. Going false with the sentinel still in view is a request of its own. */
+  settled(loading: boolean): void;
+}
+
+export function createLoadMoreTrigger(onLoadMore: () => void): LoadMoreTrigger {
+  let visible = false;
+  return {
+    seen(nowVisible, loading) {
+      visible = nowVisible;
+      if (visible && !loading) onLoadMore();
+    },
+    settled(loading) {
+      // The stall this exists for: a page too short to push the sentinel out left it in view, and
+      // no intersection CHANGE ever came to ask again.
+      if (!loading && visible) onLoadMore();
+    },
+  };
+}

package/src/index.ts

@@ -28,7 +28,6 @@ export {
   focusableWithin,
   LIVE_REGION_LEVELS,
   liveRegionAttrs,
-  nextRovingIndex,
   resetIdCounter,
   useId,
 } from './a11y';
@@ -45,13 +44,11 @@ export { AsyncRegion } from './components/AsyncRegion';
 export type { AvatarProps } from './components/Avatar';
 export { Avatar, initialsOf } from './components/Avatar';
 export type { AccordionSection } from './components/accordion-view';
-export { accordionOpenIds } from './components/accordion-view';
 export type { ShellIds, ShellLandmark, ShellSlots } from './components/app-shell-view';
-export { shellIds, shellLandmarks } from './components/app-shell-view';
+export { shellIds } from './components/app-shell-view';
 export type {
   AsyncBranch,
   AsyncFlags,
-  AsyncState,
   ReserveBox,
 } from './components/async-branch';
 export {
@@ -70,7 +67,7 @@ export { Breadcrumb } from './components/Breadcrumb';
 export type { ButtonProps } from './components/Button';
 export { Button } from './components/Button';
 export type { BarRect, ChartPoint } from './components/bar-chart-view';
-export { BAR_CHART, barRects, GRID_STEPS, gridY, maxOf } from './components/bar-chart-view';
+export { barRects } from './components/bar-chart-view';
 export type { CardProps, Elevation } from './components/Card';
 export { Card } from './components/Card';
 export type { CheckboxProps } from './components/Checkbox';
@@ -84,7 +81,7 @@ export { Container } from './components/Container';
 export type { CopyButtonProps } from './components/CopyButton';
 export { COPIED_MS, CopyButton } from './components/CopyButton';
 export type { ComboboxOption } from './components/combobox-filter';
-export { COMBOBOX_LIMIT, filterOptions, normalizeQuery } from './components/combobox-filter';
+export { filterOptions, normalizeQuery } from './components/combobox-filter';
 export type { CommandPaletteItem, PaletteKeyAction } from './components/command-palette-view';
 export {
   filterItems,
@@ -131,10 +128,7 @@ export type {
   FileTarget,
 } from './components/file-input-view';
 export {
-  acceptMatches,
-  adoptDroppedFiles,
   formatBytes,
-  progressPercent,
   selectFiles,
 } from './components/file-input-view';
 export type { GridProps } from './components/Grid';
@@ -153,11 +147,10 @@ export { InfiniteScroll } from './components/InfiniteScroll';
 export type { InputProps, InputType } from './components/Input';
 export { Input } from './components/Input';
 export type { IconElement, IconGlyph, IconTag } from './components/icon-glyph';
-export { ICON_TAGS, iconElements, isIconTag } from './components/icon-glyph';
+export { ICON_TAGS, iconElements } from './components/icon-glyph';
 export type { ImageBox, ImageLoadingHints, ImageVariant } from './components/image-source';
-export { boxFor, loadingHints, ratioFor, srcsetFor } from './components/image-source';
+export { boxFor, srcsetFor } from './components/image-source';
 export type { LoadMoreInput, LoadMoreState } from './components/infinite-scroll-view';
-export { loadMoreState } from './components/infinite-scroll-view';
 export type { KbdProps } from './components/Kbd';
 export { Kbd } from './components/Kbd';
 export type { LinkProps } from './components/Link';
@@ -165,14 +158,12 @@ export { Link } from './components/Link';
 export type { LocaleSwitcherProps } from './components/LocaleSwitcher';
 export { LocaleSwitcher, localeLabel } from './components/LocaleSwitcher';
 export type { LinkTarget } from './components/link-target';
-export { linkTarget } from './components/link-target';
 export type { MenuItem, MenuProps } from './components/Menu';
 export { Menu } from './components/Menu';
 export type { MeterProps } from './components/Meter';
 export { Meter } from './components/Meter';
 export type { MoneyProps } from './components/Money';
 export { Money } from './components/Money';
-export { meterShare, meterWidth } from './components/meter-view';
 export type { MoneyFormatter, MoneyInput, MoneyViewOptions } from './components/money-view';
 // --- formatting cores (pure, renderer-free) ----------------------------------
 export { moneyText, toMoney } from './components/money-view';
@@ -191,7 +182,6 @@ export { Radio } from './components/Radio';
 export type { RelativeTimeProps } from './components/RelativeTime';
 export { RelativeTime } from './components/RelativeTime';
 export type { RelativeTimeOptions } from './components/relative-time-view';
-export { relativeTimeText } from './components/relative-time-view';
 export type { SectionProps } from './components/Section';
 export { Section } from './components/Section';
 export type { SelectOption, SelectProps } from './components/Select';
@@ -209,11 +199,10 @@ export { StatTile } from './components/StatTile';
 export type { SwitchProps } from './components/Switch';
 export { Switch } from './components/Switch';
 export type { SortDirection, SortState } from './components/sort-state';
-export { ariaSortFor, nextSortState } from './components/sort-state';
 export type { SparkPoint } from './components/sparkline-view';
-export { SPARKLINE, sparklinePath, sparkPoints } from './components/sparkline-view';
+export { sparklinePath } from './components/sparkline-view';
 export type { StatDelta, StatTrend } from './components/stat-delta';
-export { DELTA_ARROW_PATH, deltaOf } from './components/stat-delta';
+export { deltaOf } from './components/stat-delta';
 export type { TableProps } from './components/Table';
 export { Table } from './components/Table';
 export type { TabItem, TabsProps } from './components/Tabs';
@@ -270,11 +259,9 @@ export type {
 export { issuesFromRejection, issuesFromValidation } from './form/form-issue';
 export type { FormErrors, FormState, FormStatus } from './form/form-state';
 export {
-  distributeIssues,
   errorOf,
   firstInvalidField,
   IDLE_FORM_STATE,
-  messagesOf,
   NO_FORM_ERRORS,
 } from './form/form-state';
 export type { FormTouch } from './form/form-touch';
@@ -283,7 +270,6 @@ export {
   markDirty,
   markTouched,
   NO_FORM_TOUCH,
-  sameFieldValue,
 } from './form/form-touch';
 export { valuesOfForm } from './form/form-values';
 export { useForm } from './form/use-form';
@@ -320,7 +306,7 @@ export type { UiProviderProps } from './theme/provider';
 export { UiProvider } from './theme/provider';
 // The slot is its own module so that registering a runtime does not drag `errors.ts` — and with it
 // @ultimat3/core's error registry — into an island chunk. `barrel-bytes.test.ts` holds the ceiling.
-export { clearSolidRuntime, hasSolidRuntime, setSolidRuntime } from './theme/runtime-slot';
+export { hasSolidRuntime, setSolidRuntime } from './theme/runtime-slot';
 export type { Accessor, Setter, SolidContext, SolidRuntime } from './theme/solid-adapter';
 export { solid } from './theme/solid-adapter';
 export type { ThemeEnv } from './theme/theme';
@@ -350,11 +336,8 @@ export type {
 } from './toast/toast-state';
 // --- toasts: the queue behind ToastRegion ------------------------------------
 export {
-  collapsedToasts,
-  EMPTY_TOAST_QUEUE,
   TOAST_DWELL_MS,
   TOAST_MAX_VISIBLE,
-  visibleToasts,
 } from './toast/toast-state';
 export type { ToastEnv, ToastStore } from './toast/toast-store';
 export { browserToastEnv, createToastStore, INERT_TOAST_ENV } from './toast/toast-store';
@@ -363,15 +346,13 @@ export type { Channels } from './tokens/contrast';
 export {
   AA_LARGE,
   AA_TEXT,
-  CHANNELS_PATTERN,
   contrastRatio,
   meetsContrast,
-  parseChannels,
   relativeLuminance,
   roleContrast,
 } from './tokens/contrast';
 export type { ContrastPair } from './tokens/contrast-pairs';
-export { CONTRAST_PAIRS, VISIBLE_EDGE } from './tokens/contrast-pairs';
+export { CONTRAST_PAIRS } from './tokens/contrast-pairs';
 export type { ColorRole, RadiusName, Theme } from './tokens/tokens';
 // --- tokens ------------------------------------------------------------------
 export {