freecodego 0.1.7-alpha.2.2 → 0.1.7-rc.2.3

package/dist/assets/design/craft/animation-discipline.md

@@ -0,0 +1,154 @@
+# Animation discipline craft rules
+
+Universal rules for when motion earns its place in a UI and what numbers
+constrain it. The active `DESIGN.md` decides brand-specific motion
+personality; this file decides whether motion should run at all and at
+what duration, easing, and accessibility floor.
+
+> Grounded in primary sources: Tversky/Morrison/Bétrancourt 2002
+> (IJHCS), Heer & Robertson TVCG 2007, Harrison/Yeo/Hudson CHI 2010,
+> Doherty & Thadani IBM Systems Journal 1982, Chang & Ungar UIST 1993,
+> Material 3 motion tokens, IBM `@carbon/motion`, Apple SwiftUI
+> Animation API, W3C View Transitions, WCAG 2.2.2 + 2.3.3, WebKit's
+> 2017 `prefers-reduced-motion` rationale.
+
+## When motion earns its place
+
+Tversky/Morrison/Bétrancourt's 2002 meta-analysis (IJHCS 57, pp. 247-262)
+found that every study claiming animation aids comprehension had a
+broken control — the static version had less information, different
+procedures, or hidden interactivity. When equalised, animation does
+**not** beat static for teaching complex systems. The single use case
+the paper endorses is real-time spatial or temporal reorientation:
+page transitions, container morphs, viewpoint changes, progress
+indicators (p. 257).
+
+A follow-on hazard: Palmiter & Elkerton found animation-trained users
+*declined* one week after training, while text-trained users *improved*
+(Tversky 2002, p. 255). Animation's apparent short-term parity hides
+worse retention.
+
+So animate when the user is moving through space, time, or state —
+navigation, container expansion, progress feedback, gesture
+follow-through. Don't animate to teach, decorate, signal "premium",
+or fill silence.
+
+## Duration thresholds
+
+The cross-design-system convergence is **150 ms** — Material 3 `short3`,
+IBM Carbon `moderate-01`, Shopify Polaris `150`, Tailwind default,
+SLDS `duration-fast` all land here. Use it as the default duration for
+state-confirmation feedback.
+
+| Duration | Use |
+|---|---|
+| 50–100 ms | Instant feedback (button press, toggle commit, hover) |
+| 150 ms | Default for state-confirmation |
+| 200–300 ms | Entering UI (modals, sheets, dropdowns) |
+| 300–500 ms | Cross-screen transitions, container morphs |
+| > 500 ms | Reserved for cross-screen, staged, or platform-native transitions (e.g. M3 `long2`-`extraLong4`, Heer & Robertson 2007's per-stage recommendation). |
+
+Non-navigation microinteractions — hover, press, toggle, validation,
+chip selection, row expansion — should stay under 500 ms. Past that the
+user notices the motion as motion and waits on the UI rather than
+working through it. Two qualifications: frequent animations (a hover
+effect seen 50 times per session) need to stay ≤200 ms; mobile
+animations should run 20–30% shorter than desktop equivalents because
+travel distances are shorter.
+
+## Curve vs spring
+
+Use a curve for opacity, color, and any property that changes value
+between two known points. Use a spring for position, scale, rotation,
+and gesture-driven motion — anything that should feel physical.
+
+Material 3 standard easing is `cubic-bezier(0.2, 0, 0, 1)` — front-loaded;
+the trailing zero makes the curve hit its target instantly and settle.
+M2 standard was the symmetric `cubic-bezier(0.4, 0, 0.2, 1)`, preserved
+in M3 under the name `legacy`. Anyone shipping the M2 curve and calling
+it "M3" is on legacy tokens. M3 `emphasized` is a **two-segment Bézier
+path**, not a single cubic-bezier; single-cubic approximations silently
+lose the front-loaded character. CSS `linear()` (Chrome 113+) is the
+only way to replicate it on a single property.
+
+Apple's published SwiftUI default spring is
+`(response: 0.5, dampingFraction: 0.825, blendDuration: 0)`. The widely
+cited `.snappy = 0.25 s, .smooth = 0.35 s` numbers are wrong — Apple's
+docs assign all three presets a 0.5 s base, differing only in bounce
+(0 / 0.15 / 0.3).
+
+Spring framework defaults disagree. motion.dev's physics-mode default
+is ζ ≈ 0.5 (bouncy). React Spring's `default` is ζ = 0.997 (critically
+damped). Same word "default", opposite feel — React Spring's `wobbly`
+is the actual feel-equivalent of motion.dev's `default`. Pick
+consciously.
+
+## Reduced motion
+
+Every animation that translates, scales, rotates, or parallaxes must
+respect `@media (prefers-reduced-motion: reduce)`. WebKit shipped this
+in 2017 to address vestibular triggers; the W3C MQ5 spec lets the UA
+or author **strip motion entirely or substitute static imagery** —
+the spec does not mandate which.
+
+Working rule: strip motion-on-an-axis (translate, scale, rotate,
+parallax). Keep opacity/color crossfades as substitutes when a state
+change still needs to be conveyed. Be explicit — the View Transitions
+API does **not** apply `prefers-reduced-motion` automatically; the
+author must add a query override on the pseudo-elements or skip
+`startViewTransition` entirely.
+
+WCAG calibration: 2.2.2 (Pause/Stop/Hide) is Level A — the legal floor
+under ADA Title II 2024 / EN 301 549 / EAA — but it names cognitive,
+attentional, and reading populations, not vestibular. Vestibular
+language lives in 2.3.3, which is **AAA**. Don't conflate the two.
+Building for vestibular users is a craft commitment beyond the legal
+floor, not a WCAG mandate.
+
+**Flashing limits.** WCAG 2.3.1 (Level A) permits flashing only when
+there are no more than three flashes within any one-second period, or
+the flashing area stays below the general and red flash thresholds.
+WCAG 2.3.2 (AAA) forbids flashing more than three times within any
+one-second period, regardless of area or brightness. The protected
+concern is photosensitive epilepsy; the legal floor isn't negotiable. For gamified UI, onboarding celebrations, sparkles,
+confetti, level-up bursts, and shimmer: avoid rapid flashing unless
+tested against the thresholds, and prefer one-shot animations over
+loops.
+
+## Repeated and ambient motion
+
+The rules above target one-shot transitions. Looping motion (skeleton
+shimmer, idle backgrounds, autoplay, reward bursts) has different
+constraints.
+
+- Cap iteration count: carousels at 3-5 cycles then pause; skeleton shimmer until content lands, never indefinitely.
+- WCAG 2.2.2 (Level A) requires a pause control for any motion running longer than 5 seconds — moving, blinking, or scrolling content, not only video.
+- Cancel ambient motion on route change.
+- Reward animations are one-shot. Confetti, sparkles, level-up bursts fire once and dismiss; no looping timer.
+- Spinners must not run indefinitely. Escalate to progress/cancel states and stop animation at 60 s, matching `state-coverage.md`.
+
+## Cross-platform handoff
+
+Native conventions diverge.
+
+- **iOS** uses spring physics with perceptual `(response, dampingFraction)` parameters. Apple HIG documents principles, not numerical curves; the SwiftUI Animation API JSON is the source for actual numbers. UIView curve cubic-beziers commonly cited online are reverse-engineered, not Apple-published.
+- **Android** uses cubic-bezier curves through M3 motion tokens (50–1000 ms range, 16 named durations). Predictive back is a *gesture-progress primitive*, not a transition primitive — `BackEvent.progress` is sampled per-frame from the touch stream and the destination is rendered behind the current surface while still on it. Cancellation is a first-class lifecycle state.
+- **Web** has the View Transitions API (default 0.25 s, no easing specified by the spec — falls through to CSS `ease`). Same-document support 90.94%; cross-document 87.82%. Cross-document is same-origin and user-initiated only.
+
+A "one curve fits all platforms" approach loses on each. If the brief
+specifies platform fidelity, follow the platform; if it specifies brand
+consistency, pick one motion vocabulary and apply it everywhere.
+
+## Common mistakes (lint these)
+
+- "Skeleton screens feel 11% faster" — Harrison/Yeo/Hudson CHI 2010 measured *backwards-decelerating ribbed determinate progress bars* (n=16). The induced-motion mechanism doesn't transfer to skeletons.
+- "Heer & Robertson recommend 300–1000 ms eased transitions" — they tested 1.25 s and 2 s only. Their recommendation is "~1 second per stage".
+- "Doherty Threshold = 400 ms" — the 1982 paper does not contain "400". The lowest threshold actually measured is 300 ms.
+- M2 standard easing `cubic-bezier(0.4, 0, 0.2, 1)` labelled as "Material 3". M3's standard is `cubic-bezier(0.2, 0, 0, 1)`.
+- Animations that *perform* a state change rather than *confirming* one that has already happened. Optimistic UI first; motion second.
+- More than 500 ms on any non-cross-screen transition.
+- Animation as the only signal of state change. Reduced-motion users miss it; always pair with a static affordance (color, position, label).
+- Ignoring `prefers-reduced-motion` on transform-based animations — the highest-cost vestibular triggers.
+- Curve-based animation on a `transform: scale()` that should feel physical. Use a spring.
+- Hero choreography in productivity tools. Motion budget belongs inside the product on functional micro-feedback, not on landing-page sequences.
+- Decorative motion in the working canvas of a productivity tool.

package/dist/assets/design/craft/anti-ai-slop.md

@@ -0,0 +1,84 @@
+# Anti-AI-slop rules
+
+Concrete, checkable rules that distinguish "designed by a human who has
+shipped product" from "default LLM output." Several rules below are
+auto-enforced by the daemon's `lint-artifact` linter — failing an
+enforced rule is not a style preference, it is a regression. The
+rest are guidance for agents and reviewers and are flagged inline as
+"(guidance, not auto-checked)" so the contract with the linter stays
+honest.
+
+> Adapted from [refero_skill](https://github.com/referodesign/refero_skill)
+> (MIT), tightened to match OpenDesign's lint surface.
+
+## The seven cardinal sins
+
+These are the patterns the linter blocks at P0 (must-fix):
+
+1. **Default Tailwind indigo as accent** — exactly `#6366f1`, `#4f46e5`,
+   `#4338ca`, `#3730a3`, `#8b5cf6`, `#7c3aed`, `#a855f7`. The active
+   `DESIGN.md` provides `--accent`; use it. Indigo is the textbook AI
+   tell. (The daemon's `lint-artifact` flags any of these as a solid
+   accent; keep this list in sync with `AI_DEFAULT_INDIGO` in
+   `apps/daemon/src/lint-artifact.ts`.)
+2. **Two-stop "trust" gradient on the hero** — purple→blue, blue→cyan,
+   indigo→pink. A flat surface + intentional type beats this every
+   time.
+3. **Emoji as feature icons** — ``U+2728 SPARKLES``, ``U+1F680 ROCKET``, ``U+1F3AF DIRECT HIT``, ``U+26A1 HIGH VOLTAGE``, ``U+1F525 FIRE``, ``U+1F4A1 LIGHT BULB``
+   inside `<h*>`, `<button>`, `<li>`, or `class*="icon"`. Use
+   1.6–1.8px-stroke monoline SVG with `currentColor`.
+4. **Sans-serif on display text when the seed binds a serif** — h1/h2
+   must use `var(--font-display)`, not a hardcoded Inter / Roboto /
+   `system-ui`.
+5. **Rounded card with a colored left-border accent** — the canonical
+   "AI dashboard tile" shape. Drop either the radius or the left
+   border.
+6. **Invented metrics** — "10× faster", "99.9% uptime", "3× more
+   productive". Either pull from a real source or use a labelled
+   placeholder.
+7. **Filler copy** — `lorem ipsum`, `feature one / two / three`,
+   `placeholder text`, `sample content`. An empty section is a design
+   problem to solve with composition, not by inventing words.
+
+## Soft tells (P1 — should fix)
+
+- **Standard "Hero → Features → Pricing → FAQ → CTA" sequence with no
+  variation** *(guidance, not auto-checked)*. This is the AI-template
+  skeleton; introduce at least one unconventional section (testimonial
+  wall as full-bleed quote, pricing as comparison-against-status-quo,
+  an inline mini-product-demo).
+- **External placeholder image CDNs** (`unsplash.com`, `placehold.co`,
+  `placekitten.com`, `picsum.photos`). Fragile and obvious. Use the
+  shipped `.ph-img` placeholder class.
+- **More than ~12 raw hex values outside `:root`.** Tokens were not
+  honoured.
+- **`var(--accent)` used 6+ times in the rendered body.** Cap at 2
+  visible uses per screen.
+
+## Polish tells (P2 — nice to fix)
+
+- **Sections without `data-od-id`** — comment mode can't target them.
+- **Decorative blob / wave SVG backgrounds** *(guidance, not
+  auto-checked)* — meaningless geometry.
+- **Perfect symmetric layout with no visual tension** *(guidance, not
+  auto-checked)* — alternating density (one tight section, one
+  breathing section) reads as intentional.
+
+## How to add soul without breaking the rules
+
+Aim for **~80% proven patterns + ~20% distinctive choice**. The 20%
+should live in:
+
+- One bold visual move — a typography choice, a single color decision,
+  an unexpected proportion.
+- Voice and microcopy — a button that says "Start tracking" beats one
+  that says "Get started".
+- One micro-interaction the user will remember — a button press that
+  moves 2px, a number that counts up.
+- One detail that could only have been put there by someone who used
+  the product (a subtle kbd shortcut hint, a status badge with
+  product-specific phrasing).
+
+If a reviewer screenshots the artifact and someone outside the project
+can identify which product it's from — you have soul. If not, you
+shipped a template.

package/dist/assets/design/craft/color.md

@@ -0,0 +1,88 @@
+# Color craft rules
+
+Universal color rules applied on top of the active `DESIGN.md`. The
+design system supplies the palette tokens; this file enforces how to
+*use* them.
+
+> Adapted from [refero_skill](https://github.com/referodesign/refero_skill)
+> (MIT). All examples reference OpenDesign's standard tokens
+> (`--bg`, `--surface`, `--fg`, `--muted`, `--border`, `--accent`).
+
+## Palette structure
+
+A coherent palette has four layers. Plan all four before writing any CSS.
+
+| Layer | Share of pixels | Tokens |
+|---|---|---|
+| **Neutrals** | 70–90% | `--bg`, `--surface`, `--fg`, `--muted`, `--border` |
+| **Accent** (one) | 5–10% | `--accent` only — never invent a second accent |
+| **Semantic** | 0–5% | `--success`, `--warn`, `--danger` |
+| **Effect** | <1% | gradients, glows; rarely justified |
+
+## Accent discipline
+
+The single biggest readability failure in AI-generated UIs is accent
+overuse. Hard caps:
+
+- **At most 2 visible uses of `--accent` per screen.** Typical pair:
+  one eyebrow / chip + one primary CTA. Or one accent card + one tab
+  pill. Pick a pair, not a flood.
+- Links count as accent; demote to `--fg` underline if you also have a
+  CTA on the same screen.
+- Hover/focus rings count as accent. Ration accordingly.
+
+## Contrast minimums
+
+Run these as gates, not goals:
+
+| Pair | Minimum |
+|---|---|
+| Body text (≤16 px) on background | **4.5:1** |
+| Large text (>18 px or 14 px bold) | **3:1** |
+| UI components against adjacent surfaces | **3:1** |
+
+When the brand color clashes (low-contrast indigo on light background is
+common), darken the accent to a `600`-level shade for text use; reserve
+the brand-bright variant for fills only.
+
+## Dark themes
+
+Avoid pure black and pure white — both cause vibration and eye strain.
+
+| Token | Dark theme | Light theme |
+|---|---|---|
+| Background | `#0f0f0f` (not `#000`) | `#fafafa` (not `#fff`) |
+| Foreground | `#f0f0f0` (not `#fff`) | `#111111` (not `#000`) |
+
+On dark surfaces, prefer **semi-transparent white borders** over solid
+dark borders — a 1px `rgba(255,255,255,0.08)` reads as structure
+without adding visual noise.
+
+## Semantic color naming
+
+Always name tokens by **purpose**, never by hue:
+
+```css
+/* good */
+--accent: #2f6feb;
+--success: #17a34a;
+
+/* bad — locks you out of theming */
+--blue-500: #2f6feb;
+--green-500: #17a34a;
+```
+
+## Anti-defaults
+
+- **Indigo `#6366f1`** (Tailwind `indigo-500`) is the most reliable
+  AI-slop tell. The active `DESIGN.md` provides `--accent`; use it. If
+  the brief truly needs indigo, make the user say so explicitly. If
+  your `DESIGN.md` encodes indigo as `--accent`, that is intentional —
+  the linter only flags hardcoded hex, so `var(--accent)` uses are
+  unaffected even when the resolved color happens to be `#6366f1`.
+- **Two-stop "trust" gradient** (purple → blue, blue → cyan, etc.) on a
+  hero is the second most reliable tell. A flat surface + one
+  type-driven hierarchy beats it every time.
+- **Decorative gradients with no functional purpose**. Gradients should
+  separate hierarchies (header → body, primary CTA → secondary), not
+  decorate empty space.

package/dist/assets/design/craft/form-validation.md

@@ -0,0 +1,221 @@
+# Form validation craft rules
+
+Universal rules for form validation lifecycle, error wiring beyond the
+accessibility baseline, and the schema-as-contract layer that makes
+the same validation work on the server and the client. The active
+`DESIGN.md` decides how the field looks; this file decides *when* the
+field tells the user it's wrong, *how* the error reaches assistive
+tech, and *where* the rule lives.
+
+> Grounded in primary sources: WHATWG HTML Living Standard
+> (Constraint Validation section under "Form control infrastructure"),
+> CSS Selectors L4 (`:user-invalid`), WCAG 2.2 SC 3.3.x
+> Understanding pages, ARIA APG forms patterns, Standard Schema spec
+> (`@standard-schema/spec`), Baymard 2024 inline-validation research
+> checkout-UX benchmark, WebAIM Million 2026 forms findings.
+
+## Prior art and scope
+
+Existing OSS forms guidance for AI agents pins to one layer at a time
+— `szilu/ux-designer-skill` is UX-opinion grade with no spec anchors,
+`Community-Access/accessibility-agents/forms-specialist` is
+WCAG-anchored but AT-only and doesn't reach the platform validity
+layer or the schema contract. This file connects the four layers a
+real form spans: **WHATWG Constraint Validation as the platform
+floor, validation timing as a state machine on the input, WCAG 3.3.x
+as the announcement and recovery contract, schema as the cross-stack
+truth.** A11y wiring lives next door in `accessibility-baseline.md`
+(label + describedby + invalid + `role="alert"` for inline errors);
+this file picks up where that ends.
+
+## The input state machine
+
+Every input passes through these states. The names trace back to RHF /
+Formik vocabulary on web; the *shape* applies regardless of stack.
+Drive error chrome off the state, not off raw `:invalid` or
+focus/blur booleans.
+
+| State | Meaning | UI |
+|---|---|---|
+| `pristine` | User has not interacted | No error chrome, no green check |
+| `dirty` | User has typed but not committed (still focused) | No error chrome yet |
+| `touched` | User has blurred at least once after editing | Field-level constraint runs |
+| `invalid-after-touched` | Constraint failed after blur | Show error, link via `aria-describedby` |
+| `invalid-after-submit` | Submit attempted, field still invalid | Same plus focus management to summary or first invalid field |
+| `recovering` | User editing an already-invalid field | Re-validate on `input`, not on next blur |
+| `submitting` | Action in flight | Disable submit, announce status via a polite live region |
+| `server-error` | Server returned an error for this field | Use server's message text; treat as `invalid-after-submit` |
+
+Decision rule that collapses validation-timing debates: errors appear
+on transition into `invalid-after-touched`, clear on transition out
+of any invalid state, and never appear from `pristine` or plain
+`dirty`. CSS `:user-invalid` matches the `invalid-after-touched` /
+`invalid-after-submit` states for free.
+
+## Validation timing
+
+Baymard's checkout-UX benchmark (2024-01-09 inline-validation article):
+**31% of sites have no inline validation, and most of the rest fire
+too early.** The participant quote that anchors the research: *"Why
+are you telling me my email address is wrong, I haven't had a chance
+to fill it all out yet?"* Premature firing is the loudest UX failure
+in this space.
+
+The four rules:
+
+1. **First blur after edit** runs the field-level constraint. Not on focus, not on first keystroke, not on every keystroke.
+2. **Once a field is invalid, switch to `input`-event re-validation** so the error clears the moment input becomes valid. Don't make the user blur again to dismiss it.
+3. **On submit**, run the schema parse. Move focus to the error summary at the top of the form (a heading-led container with `tabindex="-1"`, no `role="alert"` — see the wiring section), or to the first invalid field if no summary exists. Don't move focus on every keystroke.
+4. **Async checks** split into two paths. *Background preflight* (uniqueness while typing, address lookup) debounces 250-500 ms, announces via a polite live region, and never gates typing or keeps the submit button disabled indefinitely. *Authoritative server validation on submit* is different: the submit path must await the server's response and surface field errors from it, since the server is the truth. Don't conflate the two — the rule is "don't let a slow background check freeze the form," not "don't ever wait for the server."
+
+CSS gets you most of timing rule 1 for free: style off `:user-invalid`
+not `:invalid`. The `:user-invalid` selector is Baseline Newly
+available 2023 (Chrome 119, Firefox 88, Safari 16.5; Firefox shipped
+the prefixed `:-moz-ui-invalid` years earlier and unprefixed in v88)
+and matches only after the user has either submitted the form or
+blurred the field with bad input.
+
+## Constraint Validation API as the platform floor
+
+Native HTML constraints are not an alternative to JS validation; they
+are the substrate the rest of the layers run on. They survive JS
+failure, they integrate with autofill, and they are what
+`reportValidity()` and screen-reader native announcements key off.
+
+```html
+<input type="email" name="email" required>
+```
+
+Use these declaratively for every field that has them: `required`,
+`type` (email, url, number, tel), `pattern`, `min`/`max`,
+`minlength`/`maxlength`, `step`. Cross-field rules and dynamic
+constraints go through `setCustomValidity()` on both `input` and
+`change` events — autofill flows historically fired one without the
+other on some browsers, so listening on both is the cheap defense.
+
+Rules of the API:
+
+- **Empty string clears `setCustomValidity`.** Not `null`, not no-arg.
+- **`form.requestSubmit()` honors validation; `form.submit()` skips it.** Never call the second.
+- `disabled` controls are barred from validation and not submitted. The HTML spec says `readonly` is also barred, but `readonly` only has defined behavior on `<input>` and `<textarea>` — implementations diverge for `<select readonly>` and `<button readonly>` ([whatwg/html#11841](https://github.com/whatwg/html/issues/11841)). For non-input controls where the value must still submit, the safe pattern is `disabled` plus a same-named hidden `<input>` carrying the value, or rendering the non-editable text alongside a hidden `<input>`. `aria-readonly` alone is not enough — a `<select>` or custom widget tagged `aria-readonly="true"` is still interactable, so the visible control can drift while the hidden input ships a stale or different value. If you do use `aria-readonly`, you must also block the interaction or keep both values in sync.
+- `inputmode` is a virtual-keyboard hint, **not** validation. `<input type="text" inputmode="numeric" pattern="[0-9]*">` is the Baymard-recommended shape for ZIPs / OTPs / card numbers; `pattern="[0-9]*"` is the historical iOS-Safari trigger for the numeric keypad on top of `inputmode`. `type="number"` adds spinners, strips leading zeros, applies locale-decimal handling, and varies field width across browsers — wrong for any of these.
+
+## Error wiring beyond the baseline
+
+The default error pattern in `accessibility-baseline.md` (`<label>` +
+`aria-describedby` + `aria-invalid` + `role="alert"`) covers WCAG
+3.3.1 / 3.3.2. Three additions matter for real forms:
+
+**Adaptive error messages.** Baymard 2023: 98% of audited sites use
+generic catch-all errors ("Provide a valid phone number") rather than
+the specific subrule that fired ("Phone number is too short"). The
+back end already knows the subrule; surfacing it cuts re-submit
+attempts. Ship 4-7 distinct messages per high-traffic complex field
+(email, phone, card, postal code). The scale of the problem matches
+WebAIM Million 2026: missing form-input labels appear on **51% of
+the top 1M home pages** (input-level rate **33.1%** of all 6.9M
+inputs sampled) — labels and error messages are the categories
+trending sideways or worse year-over-year while overall a11y errors
+drop.
+
+**Error summary at the top, on submit only.** Long forms benefit from
+a summary list of in-page anchor links to invalid fields, focused on
+submit:
+
+```html
+<div id="form-errors" tabindex="-1">
+  <h2>2 problems</h2>
+  <ul>
+    <li><a href="#email">Email is required</a></li>
+    <li><a href="#dob">Date of birth must be in the past</a></li>
+  </ul>
+</div>
+```
+
+The container is heading-led with `tabindex="-1"` so JS can move
+focus to it on submit (render the summary into the DOM, *then*
+`.focus()` it; a `hidden` element can't take focus). It does **not**
+carry `role="alert"` because combining a moved-focus target with an
+alert role causes double-announcement: alert fires on insertion,
+focus fires the accessible name + role. Reserve `role="alert"` for
+inline per-field errors that appear without focus moving — that's
+the canonical baseline pattern in `accessibility-baseline.md`. WCAG
+technique G139 covers the summary; not required, high-value for long
+forms.
+
+**Preserve user input on error.** Baymard 2024: 34% of audited
+checkouts wipe the credit-card field when an unrelated error reloads
+the page. Direct cause of abandonment. Either field-level-validate
+non-sensitive fields first, or split the payment step. PCI-wise,
+persisting card values across an error reload is fine via tokenized
+hosted iframes; never store raw PAN in your own session.
+
+## Schema as the cross-stack contract
+
+Validation expressed once, consumed everywhere. The 2026 React shape
+— `useActionState` + Server Actions + Conform (which added Standard
+Schema support during the v1.x line) + a Zod 4 / Valibot / ArkType
+schema — is the most-cited concrete instance: one schema,
+server-authoritative, validator hot-swappable via the `~standard`
+interface. The same architecture works in TanStack Form, oRPC, Hono
+validator middleware, Nuxt UForm, and any other consumer that reads
+`~standard`.
+
+```ts
+const Signup = z.object({
+  email: z.email(),                  // Zod 4 top-level form
+  password: z.string().min(12),
+});
+// Same schema parses on the Server Action and on the Conform client.
+```
+
+Three rules that survive across stacks:
+
+- **Server is the truth, client is the optimization.** Same schema runs in both. Returning `{ errors }` from the action (not throwing) is what feeds back into `useActionState`'s state slot — throwing routes to the Error Boundary and loses the form data.
+- **Standard Schema is the contract, not Zod.** A form library that ships per-validator resolver shims (`zodResolver`, `valibotResolver`, etc.) is yesterday's stack. Accept any `~standard`-compliant validator.
+- **`novalidate` on `<form>` does not mean "skip validation".** It means "let the form library repaint errors instead of the browser's bubble." But the trade-off is real: a literal server-rendered `<form novalidate>` disables the browser's submit-blocking and native validation UI **even when JS is unavailable**, which loses the no-JS constraint-validation floor. Pick one of two patterns. **A:** render `<form>` without `novalidate` server-side and have the form library set `form.noValidate = true` after hydration — the no-JS user keeps the browser's native validation, the JS user gets the library's chrome. **B:** ship `novalidate` from the start only when the submit path reaches server validation without JS (Server Action, classic POST handler) so the no-JS user is still protected by the server. Either way, keep `required` / `pattern` / `type` attributes — they survive JS failure and integrate with autofill. (HTML attribute is lowercase `novalidate`; the IDL property on the form element is `noValidate`.)
+
+## WCAG 3.3.x beyond Error Identification
+
+`accessibility-baseline.md` covers 3.3.1 (Error ID), 3.3.2 (Labels),
+and 3.3.7 (Redundant Entry). The rest of 3.3 binds harder on
+transactional forms:
+
+- **3.3.3 Error Suggestion (AA):** when the fix is determinable, suggest it in text. Adaptive errors satisfy this. "Date must be MM/DD/YYYY. You entered 5-3-26. Did you mean 05/03/2026?"
+- **3.3.4 Error Prevention — Legal, Financial, Data (AA):** for any submission with legal / financial / data-modifying consequence, provide one of: reversibility, server-side check + correction step, or a confirm-summary screen before commit.
+- **3.3.8 Accessible Authentication (AA, WCAG 2.2):** auth steps must not require a cognitive function test (remember a password, transcribe a code, recognize images) without an alternative. CAPTCHAs are the canonical thing this SC restricts; only object-recognition or personal-content variants escape via the narrow exceptions, and not all CAPTCHAs do. Practical floor: never block paste on password / verification-code fields, support password managers, accept verification-code paste from a clipboard.
+- **3.3.9 Accessible Authentication, No Exception (AAA):** removes even the object-recognition / personal-content exceptions. Aspirational; flag if a project commits to it.
+
+## Native mobile parity
+
+Web validation primitives don't auto-translate. Each platform has its
+own validity machinery and its own AT path. Skills that emit web-only
+artifacts can skim this section; it's the entry point for skills
+that ship to mobile (mobile-onboarding, mobile-app, etc.).
+
+| Platform | Validity primitive | Error announcement |
+|---|---|---|
+| iOS UIKit | Hand-rolled state on the view controller; `UITextField` doesn't carry a built-in invalid flag | `UIAccessibility.post(notification: .announcement, argument: "Email is required")` |
+| iOS SwiftUI | `TextField` + `@State`-driven validation; no built-in `Form`-level validity API as of iOS 18 | `AccessibilityNotification.Announcement("…").post()` (iOS 17+) |
+| Android Compose | `OutlinedTextField(isError = true, supportingText = { Text("…") })` — `isError` wires the AT error semantic for you | `Modifier.semantics { liveRegion = LiveRegionMode.Polite }` on the supporting-text node, or `LocalView.current.announceForAccessibility(message)` |
+| Flutter | `TextFormField(validator: (v) => …)` inside a `Form`, `formKey.currentState!.validate()` | `SemanticsService.announce(message, Directionality.of(context))` — never hardcode `TextDirection.ltr`; pull ambient direction so Arabic / Hebrew / Persian flows announce correctly |
+| React Native | Hand-rolled per field; no platform validity flag | `accessibilityLiveRegion="polite"` on the error node (Android) + `AccessibilityInfo.announceForAccessibility(...)` (iOS) |
+
+Two parity rules that catch most AI-generated mobile forms:
+
+- **Use the platform's native validation flag — and pair it with the platform's error-message semantic where one exists.** On Compose, `isError = true` is the right boolean state for the field visuals and AT error-state cue, but it does *not* carry the localized error message. Pair it with `Modifier.semantics { error(message) }` so accessibility services get the actual text — the same string you render in `supportingText`. The trap is duplication: a hand-rolled `Modifier.semantics { error("Email is required") }` next to a different supporting-text string desyncs. Source `error()` from the same state field as `supportingText` so they stay in sync.
+- **Don't mirror web ARIA into mobile semantics.** `aria-describedby` on a SwiftUI `TextField` is a no-op. Use the platform announcement primitive (`AccessibilityNotification.Announcement` on SwiftUI, `UIAccessibility.post` on UIKit, `announceForAccessibility` on Android, `SemanticsService.announce` on Flutter) for state-change events that need to reach the screen reader.
+
+## Common mistakes (lint these)
+
+- Styling off `input:invalid` instead of `input:user-invalid`. Red borders on page load is the loudest "this validation was added without testing" signal.
+- Validating on every keystroke. Hostile; fires before the user has finished typing.
+- Generic catch-all error messages ("Invalid input") when the back end already knows which subrule fired. Baymard 2023 found 98% of audited sites do this — the most-cited preventable validation failure in their corpus.
+- Throwing from a Server Action on validation failure. Routes to the Error Boundary and loses the form data. Return `{ errors }` instead.
+- `role="alert"` on the error-summary container that focus moves to. Double-announces. Reserve `role="alert"` for inline per-field errors that appear without focus moving.
+- `aria-busy="true"` on the submit button while submitting. `aria-busy` is for stale containers; for buttons use `disabled` plus a polite live-region status message.
+- Email-confirm fields ("retype your email"). 3.3.7 redundant entry — exceptions are essential / security / no-longer-valid, not "we want to catch typos." Allow paste and validate the single field instead.
+- Per-validator resolver shims (`zodResolver`, `valibotResolver`) on a 2026 stack. Accept Standard Schema's `~standard` interface and the validator becomes swappable.
+- Wiping the credit-card field when an unrelated field errors. Baymard 2024: 34% of audited e-commerce sites; direct abandonment cause.
+- `setCustomValidity(null)` to clear an error. Pass empty string; `null` does not clear.
+- Mirroring web ARIA onto SwiftUI / Compose / Flutter. Each platform has its own validity API; `aria-*` attributes don't reach the mobile AT path.