mosaic-headless 1.12.0 → 1.13.0

package/README.ja.md

@@ -30,6 +30,7 @@ python tools/mo.py type accordion-content   # 1 つの型を、全ライブス
 python tools/mo.py check div text button    # 危険な型・未知の型があれば exit 1
 python tools/mo.py style --grouped          # 単独設定では必ず効かない 20 個
 python tools/mo.py states --verified        # 実測でコンパイルされた状態だけ
+python tools/mo.py params text              # 1 つの型に設定できるものすべて
 ```
 
 そのうえでページを見る。Mosaic の失敗の仕方は 4 通りあり、
@@ -60,6 +61,7 @@ URL に対応するテンプレなし   HTTP 406、未ログインには空の b
 | **スタイルプロパティ** | 98 / 98 を実ページに書き、コンパイル済み CSS と照合：58 COMPILED、18 ABSENT、21 SKIPPED |
 | **ノードプロパティ** | 181 / 181 を、各プロパティ自身の validator chain から導いた値で再測定：35 APPLIED、42 NO_EFFECT、55 NO_HOST、47 SKIPPED |
 | **レスポンシブ** | 2 サイト計 688 件の `_t`/`_m` 宣言を、サイトが実際に配信したスタイルシートに対して 1 件ずつ断言 — 全件検証済み |
+| **コンポーネント** | コンポーネント機構を端から端まで実行し **8 / 8**：カテゴリ配下に作成、ドキュメントを heal、書き込み可能な instance 経由でツリーを投入、読み取り専用の方は同じ書き込みを拒否（ネガティブコントロール）、最後に 2 つのインスタンスが 1 つの定義から描画 |
 | **スタイル状態** | 53 状態のうち 52 を実ページに書き、テーブルが約束するセレクタと照合：**36 件が完全一致**、12 件 NO_HOST、3 件 SKIPPED、1 件 BROKE_PAGE。どの要素にも使えるグローバル 7 状態はすべて検証済み |
 | **インタラクション** | JS アニメーション経路を、ネガティブコントロール付きで保存行を読み戻しながら検証：`propertyMetas` は**受理され保存される**。プロパティ値は依然としてバインドされないが、その境界は厳密になった |
 | **入場アニメーション** | ページ読み込み後の 10 時点をサンプリングし 7 項目を断言 — 再生されること、アニメーションする `@property` カウンタが 100 に達すること、ベールがヒットテストから外れること、ビューポート内に opacity 0 のまま取り残された要素がないこと、実際のクリックが文書に届くこと、そして `prefers-reduced-motion` ではベールがそもそも存在しないこと |

package/README.ko.md

@@ -30,6 +30,7 @@ python tools/mo.py type accordion-content   # 타입 하나를 모든 라이브
 python tools/mo.py check div text button    # 위험하거나 존재하지 않는 타입이면 exit 1
 python tools/mo.py style --grouped          # 단독으로 설정하면 반드시 무효인 20개
 python tools/mo.py states --verified        # 실측으로 컴파일이 확인된 상태만
+python tools/mo.py params text              # 한 타입에 설정 가능한 모든 것
 ```
 
 그리고 페이지를 확인한다. Mosaic의 실패 방식은 네 가지이고,
@@ -60,6 +61,7 @@ URL에 맞는 템플릿 없음      HTTP 406, 로그인하지 않은 사용자
 | **스타일 속성** | 98 / 98을 실제 페이지에 쓰고 컴파일된 CSS와 대조: 58 COMPILED, 18 ABSENT, 21 SKIPPED |
 | **노드 속성** | 181 / 181을 각 속성 자신의 validator chain에서 도출한 값으로 재측정: 35 APPLIED, 42 NO_EFFECT, 55 NO_HOST, 47 SKIPPED |
 | **반응형** | 두 사이트 합쳐 688개의 `_t`/`_m` 선언을, 사이트가 실제로 내보낸 스타일시트에 대해 하나씩 단언 — 전부 검증됨 |
+| **컴포넌트** | 컴포넌트 체계를 끝까지 구동해 **8 / 8**: 카테고리 아래 생성, 문서 heal, 쓰기 가능한 instance로 트리 주입, 읽기 전용 쪽은 같은 쓰기를 거부(음성 대조군), 마지막으로 인스턴스 2개가 정의 하나로 렌더링 |
 | **스타일 상태** | 53개 상태 중 52개를 실제 페이지에 쓰고 표가 약속한 셀렉터와 대조: **36개가 정확히 일치**, 12개 NO_HOST, 3개 SKIPPED, 1개 BROKE_PAGE. 어떤 요소에나 쓸 수 있는 전역 7개 상태는 전부 검증됨 |
 | **인터랙션** | JS 애니메이션 경로를 음성 대조군과 함께, 저장된 행을 되읽으며 검증: `propertyMetas`는 **수용되고 저장된다**. 속성 값은 여전히 바인딩되지 않지만 그 경계는 이제 정확하다 |
 | **인트로 애니메이션** | 페이지 로드 후 10개 시점을 샘플링해 7가지를 단언 — 재생될 것, 애니메이션되는 `@property` 카운터가 100에 도달할 것, 베일이 히트 테스트에서 빠질 것, 뷰포트 안에 opacity 0으로 갇힌 요소가 없을 것, 실제 클릭이 문서에 닿을 것, 그리고 `prefers-reduced-motion`에서는 베일이 아예 존재하지 않을 것 |

package/README.md

@@ -30,6 +30,7 @@ python tools/mo.py type accordion-content   # one type, joined to every live swe
 python tools/mo.py check div text button    # exits 1 on an unsafe or unknown type
 python tools/mo.py style --grouped          # the 20 that are inert set on their own
 python tools/mo.py states --verified        # the states measured to compile
+python tools/mo.py params text              # everything settable on one type
 ```
 
 Then check the page. Mosaic has four failure modes and **only one of them changes the
@@ -61,6 +62,7 @@ factories, so Pro types register and render regardless.
 | **style properties** | 98 / 98 written to a live page and checked against the compiled CSS: 58 COMPILED, 18 ABSENT, 21 SKIPPED |
 | **node properties** | 181 / 181 re-probed with a value shaped by each property's own validator chain: 35 APPLIED, 42 NO_EFFECT, 55 NO_HOST, 47 SKIPPED |
 | **responsive** | 688 `_t`/`_m` declarations across two sites asserted against the stylesheet the site actually served — all verified |
+| **components** | the component system driven end to end, **8 of 8**: created under a category, document healed, tree filled through the writable instance, the read-only one refused the same write as a negative control, and two instances on a page rendering one definition twice |
 | **style states** | 52 of the 53 states written to a live page and matched against the selector the table promises: **36 compiled exactly**, 12 NO_HOST, 3 SKIPPED, 1 BROKE_PAGE. All seven globally usable states verified |
 | **interactions** | the JS animation path probed with negative controls and the row read back: `propertyMetas` **is** accepted and stored; the property values still do not bind, and the boundary is now exact |
 | **entrance animation** | the page-load sequence sampled at ten timestamps and asserted on seven counts — it plays, its animated `@property` counter reaches 100, the veil leaves hit-testing, nothing in the viewport is stranded at opacity 0, a real click reaches the document, and under `prefers-reduced-motion` the veil never exists at all |

package/README.zh-TW.md

@@ -26,6 +26,7 @@ python tools/mo.py type accordion-content   # 一個型別，接上所有線上
 python tools/mo.py check div text button    # 型別不安全或不存在就 exit 1
 python tools/mo.py style --grouped          # 那 20 個單獨設定必然無效的屬性
 python tools/mo.py states --verified        # 實測會編譯出來的狀態
+python tools/mo.py params text              # 一個型別上所有能設的東西
 ```
 
 然後去看頁面。Mosaic 有四種失效模式，**其中只有一種會改變 HTTP 狀態碼**：
@@ -53,6 +54,7 @@ commit 時 PHP fatal   HTTP 500  （122 種型別裡有 15 種，光放在 div
 | **樣式屬性** | 98 / 98 寫進真實頁面並對照編譯後的 CSS：58 COMPILED、18 ABSENT、21 SKIPPED |
 | **節點屬性** | 181 / 181，用每個屬性自己的 validator chain 推導出的值重測：35 APPLIED、42 NO_EFFECT、55 NO_HOST、47 SKIPPED |
 | **響應式** | 兩個站共 688 條 `_t`/`_m` 宣告，對照網站實際送出的樣式表逐條斷言——全數通過 |
+| **元件系統** | 完整驅動過一遍，**8 / 8**：在分類下建立、文件 heal、透過可寫的 instance 填入內容、唯讀的那個作為負對照組確實拒絕同一個寫入，最後兩個實例在頁面上由同一份定義渲染兩次 |
 | **樣式狀態** | 53 個狀態中的 52 個寫進真實頁面，對照表格承諾的選擇器逐一比對：**36 個完全吻合**、12 個 NO_HOST、3 個 SKIPPED、1 個 BROKE_PAGE。七個可用於任何元素的狀態全數驗證 |
 | **互動動畫** | 帶負對照組並讀回儲存列來探測 JS 動畫路徑：`propertyMetas` **確實**會被接受並儲存；屬性值仍然無法綁定，但界線現在很精確 |
 | **入口動畫** | 在載入後十個時間點取樣並做七項斷言——它有播、被動畫的 `@property` 計數器跑到 100、遮罩退出點擊判定、視窗內沒有任何內容卡在 opacity 0、真實點擊落在文件上，而在 `prefers-reduced-motion` 下遮罩根本不存在 |

package/SKILL.md

@@ -4,7 +4,7 @@ description: |
   Build and modify Mosaic Pro (Nextend) sites by writing the underlying data model directly - no visual editor, no DOM. Query the real surface with `mo.py`, which joins every source table to the live sweeps so a lookup leads with the measured verdict rather than the declaration (122 node types, 181 properties, 98 style properties with 20 structured value shapes pinned down, 53 style states, 151 element classes, 74 dynamic variables, 12 interaction triggers, 114 REST routes, 23 tables) instead of guessing, with every node type placed on a live site one at a time and asserted against the delivered HTML, the design-token and element-class layers verified against compiled CSS, the @VAR() dynamic language verified against rendered output, nine designed pages built through the tables themselves, and the delivered page re-read in Chromium at three viewports so a rule that is present, correct and still wrong cannot pass.
 license: "MIT"
 author: "moksa (https://moksaweb.com)"
-version: "1.12.0"
+version: "1.13.0"
 ---
 
 # Headless Mosaic
@@ -30,6 +30,9 @@ thing about that type worth knowing.
 ```bash
 python tools/mo.py stats                    # the surface, and what is unsafe
 python tools/mo.py type accordion-content   # ONE type, joined to every sweep
+python tools/mo.py params text              # EVERYTHING settable on a type:
+                                            # data properties, the states that
+                                            # reach it, the style surface, placement
 python tools/mo.py types --edition pro --safe
 python tools/mo.py check div text button    # exits 1 on an unsafe or unknown type
 python tools/mo.py placement accordion-item # what goes inside what, both directions
@@ -147,6 +150,12 @@ STATES       52 of the 53 style states written to a live page and matched agains
              pseudo-classes are emitted UPPERCASE (`.M_EL9:HOVER`), so grepping a
              stylesheet for `:hover` finds nothing. data/style-state-verification.csv
 
+COMPONENTS   the component system driven end to end, 8 of 8 checks: a component
+             created under a category, its document healed, its tree filled through
+             the WRITABLE instance, the read-only one refused the same write as a
+             negative control, and two instances placed on a page rendering the one
+             definition twice. data/component-verification.csv
+
 INTERACTION  the JS animation path, probed with negative controls and the row read
              back: `propertyMetas` IS accepted and stored (the earlier claim that it
              never survived was wrong), `uuid` per item is optional on create and
@@ -320,6 +329,8 @@ so the pattern is in the data, not just in this paragraph.
 | `data/design-audit.csv` | 24 | **computed in Chromium** - contrast, font fallback, CJK tracking, overflow, measure. Empty means it ran and found nothing |
 | `data/data-class-hierarchy.csv` | 121 | source - every data class and its parent, so a type's inherited properties can be resolved |
 | `data/style-state-verification.csv` | 52 | **swept live** - each state written on a host of its own type and matched against its promised selector |
+| `data/component-verification.csv` | 8 | **driven live** - the component lifecycle, each step asserted against the row or the delivered HTML |
+| `data/node-type-notes.csv` | 4 | where a sweep outcome is true but misleading on its own, why. Surfaced by `mo.py type` |
 | `data/interaction-verification.csv` | 7 | **probed live** - interaction animation shapes, with negative controls and the stored row beside the payload |
 | `data/intro-verification.csv` | 7 + 10 | **sampled live** - the entrance sequence over ten timestamps, plus the seven assertions about it |
 | `data/element-classes.csv` | 151 | **live** — the built-in class metas; their IDs are what an `elementClass` record must use |
@@ -433,6 +444,7 @@ post — `build_all.py` resets first for that reason.
 | `sweep_style_properties.py` | write every style property and check the compiled CSS |
 | `sweep_node_properties.py` | probe every node property with a value from its own validator chain |
 | `sweep_style_states.py` | write every style state and check the selector it compiled to |
+| `sweep_components.py` | build a component, instance it twice, and prove one definition served both |
 | `sweep_interactions.py` | which interaction animation shapes survive to the frontend payload |
 | `theme_export.php` / `theme_import.php` | move a whole theme across installs, ids intact |
 | `copy_styles.py` | push one node's style onto others, by attrID or prefix |

package/assets/templates/platforms/claude-ai.json

@@ -20,7 +20,7 @@
     "description": "Build and modify Mosaic Pro (Nextend) sites by writing the underlying data model directly - no visual editor, no DOM. Query the real surface (122 node types, 181 node properties, 98 style properties, 53 style states, 151 element classes, 74 dynamic variables, 114 REST routes, 23 tables) instead of guessing, with every node type placed on a live site one at a time and asserted against the delivered HTML, every style and node property swept against the compiled CSS and markup, and 569 responsive declarations checked against the stylesheet the site actually served.",
     "license": "MIT",
     "author": "moksa (https://moksaweb.com)",
-    "version": "1.12.0"
+    "version": "1.13.0"
   },
   "loaderBehaviour": "Upload via Settings -> Skills -> Upload. Claude.ai parses SKILL.md frontmatter and surfaces the skill in your library. The extraction tool (extract-block-schema.php) needs a live WP-CLI connection and won't run in the sandbox; use it from a local terminal against your own site instead.",
   "uploadSteps": [

package/assets/templates/platforms/claude-code.json

@@ -20,7 +20,7 @@
     "description": "Build and modify Mosaic Pro (Nextend) sites by writing the underlying data model directly - no visual editor, no DOM. Query the real surface (122 node types, 181 node properties, 98 style properties, 53 style states, 151 element classes, 74 dynamic variables, 114 REST routes, 23 tables) instead of guessing, with every node type placed on a live site one at a time and asserted against the delivered HTML, every style and node property swept against the compiled CSS and markup, and 569 responsive declarations checked against the stylesheet the site actually served.",
     "license": "MIT",
     "author": "moksa (https://moksaweb.com)",
-    "version": "1.12.0"
+    "version": "1.13.0"
   },
   "loaderBehaviour": "Auto-loads on session start when SKILL.md frontmatter parses successfully.",
   "verified": true,

package/assets/templates/platforms/codex-cli.json

@@ -20,7 +20,7 @@
     "description": "Build and modify Mosaic Pro (Nextend) sites by writing the underlying data model directly - no visual editor, no DOM. Query the real surface (122 node types, 181 node properties, 98 style properties, 53 style states, 151 element classes, 74 dynamic variables, 114 REST routes, 23 tables) instead of guessing, with every node type placed on a live site one at a time and asserted against the delivered HTML, every style and node property swept against the compiled CSS and markup, and 569 responsive declarations checked against the stylesheet the site actually served.",
     "license": "MIT",
     "author": "moksa (https://moksaweb.com)",
-    "version": "1.12.0"
+    "version": "1.13.0"
   },
   "loaderBehaviour": "Confirmed (2026-07-11): Codex CLI natively supports the SKILL.md spec. Place SKILL.md under .codex/skills/<name>/ (project) or ~/.codex/skills/<name>/ (personal) and Codex loads the name+description at session start, then the full body on demand. A parallel, broader convention .agents/skills/ (searched from cwd up to repo root, then ~/.agents/skills/) also exists across multiple tools - if your Codex CLI version prioritizes that path instead, mirror the same SKILL.md there.",
   "verified": true,

package/assets/templates/platforms/copilot.json

@@ -20,7 +20,7 @@
     "description": "Build and modify Mosaic Pro (Nextend) sites by writing the underlying data model directly - no visual editor, no DOM. Query the real surface (122 node types, 181 node properties, 98 style properties, 53 style states, 151 element classes, 74 dynamic variables, 114 REST routes, 23 tables) instead of guessing, with every node type placed on a live site one at a time and asserted against the delivered HTML, every style and node property swept against the compiled CSS and markup, and 569 responsive declarations checked against the stylesheet the site actually served.",
     "license": "MIT",
     "author": "moksa (https://moksaweb.com)",
-    "version": "1.12.0"
+    "version": "1.13.0"
   },
   "loaderBehaviour": "CHANGED as of 2026-07-11: GitHub Copilot added a proper '.github/skills/' Agent Skills directory (December 2025), alongside the older single-file .github/copilot-instructions.md convention. This config targets the new skills-directory form. If your Copilot version predates this (pre Dec 2025), use the instructions-append fallback instead (see fallback below).",
   "fallback": {

package/assets/templates/platforms/gemini-cli.json

@@ -20,7 +20,7 @@
     "description": "Build and modify Mosaic Pro (Nextend) sites by writing the underlying data model directly - no visual editor, no DOM. Query the real surface (122 node types, 181 node properties, 98 style properties, 53 style states, 151 element classes, 74 dynamic variables, 114 REST routes, 23 tables) instead of guessing, with every node type placed on a live site one at a time and asserted against the delivered HTML, every style and node property swept against the compiled CSS and markup, and 569 responsive declarations checked against the stylesheet the site actually served.",
     "license": "MIT",
     "author": "moksa (https://moksaweb.com)",
-    "version": "1.12.0"
+    "version": "1.13.0"
   },
   "loaderBehaviour": "CHANGED as of 2026-07-11: Gemini CLI now natively supports the same SKILL.md standard as Claude Code and Codex CLI - the same directory-based skill works unmodified. Gemini CLI discovers skills in this precedence order: built-in, extension skills, ~/.gemini/skills/ (personal), .gemini/skills/ (project, shared via version control). At session start Gemini injects each discovered skill's name+description into the system prompt and calls activate_skill when a task matches.",
   "verified": true,

package/data/component-verification.csv

@@ -0,0 +1,9 @@
+step,result,detail
+categories exist,PASS,"Page, Block, Part"
+component created,PASS,parented to 'Page'
+document healed,PASS,"first GET 404'd, second gave component-internal"
+component filled,PASS,"tree is component-internal, div, text, wysiwyg-text"
+read-only instance refuses,PASS,componentNodeEditorInstance rejected the same commit
+instances committed,PASS,type carries the component id
+both instances rendered,PASS,2 instance elements in the delivered HTML
+component content reused,PASS,the component's own text appears 2 times from ONE definition

package/data/node-type-notes.csv

@@ -0,0 +1,5 @@
+type,note
+component-instance,"Swept as COMMIT_500, which is what a BARE one does. The node's type is not `component-instance` but `component-instance/<componentID>` - the factory splits on that slash and a bare one has no id to read. With a real component it commits and renders; see sweep_components.py."
+component-internal,"The component's content hangs under THIS node, in the `node/component/<id>` key of a componentDocumentInstance. `component-root` looks like the parent and accepts no children."
+component-root,"Accepts no children. It frames the component's preview document, not its content."
+loop,"COMMIT_500 on a bare page: the loop needs a query context that a plain document does not provide."

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mosaic-headless",
-  "version": "1.12.0",
+  "version": "1.13.0",
   "description": "AI-agent skill: build Mosaic Pro (Nextend) WordPress sites by writing the underlying data model directly - 23 custom tables, no visual editor, no DOM. Every node type, style property and node property swept against a live install and asserted on the delivered HTML and compiled CSS. Installs into Claude Code, Cursor, Codex CLI, Gemini CLI, Copilot, Continue, Windsurf and Claude.ai.",
   "keywords": [
     "wordpress",

package/references/data-model.md

@@ -93,3 +93,41 @@ takes variations from there.
 That is why the same visual change can be made in two very different places, and
 why writing a style onto a node directly is usually the wrong move: the class is
 the unit of reuse, and the collection/variable tables are the token layer beneath it.
+
+
+## Components: one definition, many places
+
+Three tables (`components`, `component_documents`, `component_categories`), four
+node types and eighteen REST routes. Driven end to end by
+`tools/sweep_components.py`; every claim here was measured, and none of it is
+guessable from the route list.
+
+```
+1  create      adminComponentsEditorInstance, commit a `component` record
+               parentType MUST be "componentCategory" - Page, Block and Part exist
+               out of the box, and no other parent type is accepted at all.
+               parentType:"" gives HTTP 500, "Parent type not supported"
+
+2  heal        GET componentDocumentInstance/<id>
+               the FIRST call 404s and creates the document; the second returns it,
+               healed into body / component-external / component-root / document
+
+3  fill        commit into the SAME instance, under the `component-internal` node
+               in its `node/component/<id>` key.
+               NOT componentNodeEditorInstance - `isCommitAllowed()` returns false
+               there and the commit is refused with "Not allowed!" and a 500, even
+               though that is the instance which shows you the tree.
+               NOT component-root either - it accepts no children
+
+4  instance    on a page, a node whose TYPE carries the component's id:
+                   type: "component-instance/<componentID>"
+               `ComponentInstanceElementTypeFactory` splits on that slash. A bare
+               `component-instance` has no id for `$flags[0]` and fatals, which is
+               the entire reason it is COMMIT_500 in node-verification.csv
+```
+
+Verified on a live page: two instances of one component, both rendered, the
+component's own text present twice from a single definition. Edit the component and
+every instance changes - which is the whole point, and the reason a real site should
+use these rather than repeating a tree.
+

package/tools/mo.py

@@ -104,6 +104,21 @@ def table(headers, body, gap=2):
         print(sep.join(c.ljust(width[i]) for i, c in enumerate(r)).rstrip())
 
 
+def wrap(text: str, width: int) -> list[str]:
+    """Break on spaces. Slicing every N characters splits words in half, which in a
+    note about `component-instance/<componentID>` is actively misleading."""
+    out, line = [], ""
+    for word in (text or "").split():
+        if line and len(line) + 1 + len(word) > width:
+            out.append(line)
+            line = word
+        else:
+            line = (line + " " + word) if line else word
+    if line:
+        out.append(line)
+    return out
+
+
 def matches(text: str, needle: str | None) -> bool:
     return needle is None or needle.lower() in (text or "").lower()
 
@@ -119,6 +134,14 @@ def type_record(name: str) -> dict:
             name, ("\ndid you mean: " + ", ".join(near[:8])) if near else ""))
 
     v = index("node-verification", "type").get(name, {})
+    # A sweep outcome is what happened to ONE probe. Where that number is true but
+    # misleading on its own, the note says why - `component-instance` is COMMIT_500
+    # only because a bare one has no component id in its type.
+    note = ""
+    try:
+        note = index("node-type-notes", "type").get(name, {}).get("note", "")
+    except SystemExit:
+        note = ""
     p = index("placement-rules", "type").get(name, {})
     d = index("default-children", "type").get(name, {})
 
@@ -148,6 +171,7 @@ def type_record(name: str) -> dict:
         "edition": t.get("edition"),
         "outcome": v.get("outcome"),
         "outcome_note": OUTCOME_NOTE.get(v.get("outcome"), ""),
+        "note": note,
         "safe_to_commit": v.get("outcome") not in UNSAFE,
         "detail": v.get("detail"),
         "rendered_tag": v.get("rendered_tag"),
@@ -207,6 +231,9 @@ def cmd_type(a):
         print("verdict   : %s" % flag)
         if rec["detail"]:
             print("failure   : %s" % rec["detail"])
+        if rec["note"]:
+            for i, line in enumerate(wrap(rec["note"], 74)):
+                print("%-11s %s" % ("note      :" if i == 0 else "", line))
         if rec["rendered_tag"]:
             print("renders as: <%s>%s" % (
                 rec["rendered_tag"],
@@ -244,6 +271,96 @@ def cmd_type(a):
     emit(rec, render)
 
 
+def cmd_params(a):
+    """Everything that can be SET on one node type, in one answer.
+
+    This is the question you actually have in front of an editor: not "does this
+    type exist" but "what may I put on it, in what shape, and which of those have
+    been seen to work". It is four tables joined - node properties by the data
+    class, the universal style surface, the style states that reach this type, and
+    the placement rule - because the answer is not in any one of them.
+
+    Mosaic differs from a widget-based builder here in a way worth stating: the
+    STYLE surface is universal. Every element takes the same 98 style properties;
+    what varies per type is the DATA properties and which node-type-scoped states
+    apply. So the style half of this output is the same for every type, and that
+    is a fact about the platform rather than a shortcut taken here."""
+    rec = type_record(a.name)
+    prop_status = {r["property"]: r for r in rows("node-property-verification")}
+    sv = index("style-verification", "property")
+    shapes = index("style-value-shapes", "property")
+    ver = index("style-state-verification", "state")
+
+    states = []
+    for r in rows("style-states"):
+        v = ver.get(r["state"], {})
+        if r["scope"] == "global" or v.get("host") == a.name:
+            states.append({"state": r["state"], "scope": r["scope"],
+                           "selector": r["selector_template"],
+                           "status": v.get("status", "base state"
+                                           if r["state"] == "&" else "")})
+
+    style = []
+    for r in rows("style-properties"):
+        v = sv.get(r["property"], {})
+        style.append({"property": r["property"], "group": r["group"],
+                      "css": v.get("css_property", ""),
+                      "status": v.get("status", ""),
+                      "shape": shapes.get(r["property"], {}).get("shape", ""),
+                      "accepted_values": split(r["accepted_values"])})
+
+    payload = {"type": a.name, "safe_to_commit": rec["safe_to_commit"],
+               "note": rec["note"], "data_properties": rec["properties"],
+               "style_properties": style, "states": states,
+               "placement_rule": rec["placement_rule"],
+               "allowed_children": rec["allowed_children"]}
+
+    def render():
+        head("%s - everything settable" % a.name)
+        print("verdict   : %s%s"
+              % ("SAFE" if rec["safe_to_commit"] else "UNSAFE TO COMMIT",
+                 "  (%s)" % rec["outcome"] if rec["outcome"] else ""))
+        if rec["note"]:
+            for i, line in enumerate(wrap(rec["note"], 74)):
+                print("%-11s %s" % ("note      :" if i == 0 else "", line))
+
+        print("\nDATA properties (%d) - these vary by type"
+              % len(rec["properties"]))
+        table(["property", "shared", "verified", "accepted values"],
+              [[p["property"], "yes" if p["inherited_from"] else "",
+                (prop_status.get(p["property"]) or {}).get("status", ""),
+                ", ".join(p["accepted_values"])[:44]]
+               for p in rec["properties"]])
+
+        usable = [s for s in states if s["status"] in ("COMPILED", "base state")]
+        print("\nSTATES reaching this type (%d usable of %d)"
+              % (len(usable), len(states)))
+        table(["state", "scope", "swept", "selector"],
+              [[s["state"], s["scope"], s["status"], s["selector"][:44]]
+               for s in states])
+
+        ok = [p for p in style if p["status"] == "COMPILED"]
+        grouped = [p for p in style if p["group"]]
+        print("\nSTYLE properties: %d in the surface, %d measured COMPILED,"
+              " %d belong to a group and are INERT set on their own."
+              "\nThe style surface is UNIVERSAL in Mosaic - it is the same "
+              "for every type."
+              % (len(style), len(ok), len(grouped)))
+        if a.style:
+            table(["property", "group", "css", "swept", "shape"],
+                  [[p["property"], p["group"], p["css"], p["status"],
+                    p["shape"][:30]] for p in style])
+        else:
+            print("(pass --style to list them, or `mo.py style` for the same "
+                  "table on its own)")
+
+        print("\nCHILDREN  : rule=%s%s" % (rec["placement_rule"],
+              ("  " + ", ".join(rec["allowed_children"]))
+              if rec["allowed_children"] else ""))
+
+    emit(payload, render)
+
+
 def cmd_types(a):
     ver = index("node-verification", "type")
     out = []
@@ -655,6 +772,12 @@ def main():
     p = add("type", cmd_type, "one node type, fully joined")
     p.add_argument("name")
 
+    p = add("params", cmd_params,
+            "EVERYTHING settable on one type: data, style, states, placement")
+    p.add_argument("name")
+    p.add_argument("--style", action="store_true",
+                   help="list all 98 style properties too, not just count them")
+
     p = add("check", cmd_check, "exit 1 if any named type is unsafe or unknown")
     p.add_argument("names", nargs="+")
 

package/tools/sweep_components.py

@@ -0,0 +1,215 @@
+#!/usr/bin/env python3
+"""Drive Mosaic's component system end to end, and check every step.
+
+    python tools/sweep_components.py --config c.json --post 20 --slug probe-lab
+    python tools/sweep_components.py --config c.json --post 20 --slug probe-lab \
+        --csv data/component-verification.csv
+
+Components are how a Mosaic site stops repeating itself: build a card once, place it
+in twenty documents, edit the one and all twenty change. Three tables, four node
+types and eighteen REST routes serve it, and this skill had never touched any of
+them - `component-instance` sat in `node-verification.csv` as COMMIT_500, which is
+true and useless, because it only says what happens when you commit one WRONG.
+
+Four things had to be found out, and none is guessable:
+
+1.  **A component must hang off a `componentCategory`.** `parentType:""` gives
+    `Uncaught Exception: Parent type not supported` and an HTTP 500. Three
+    categories exist out of the box - Page, Block, Part - and the manager accepts
+    no other parent type at all.
+
+2.  **The component's document is created lazily by the first GET.** Ask for
+    `componentDocumentInstance/<id>` immediately after creating the component and it
+    is a 404; ask again and it is there, healed into body / component-external /
+    component-root / document.
+
+3.  **`componentNodeEditorInstance` is READ ONLY.** Its `isCommitAllowed()` returns
+    `false`, so a commit there is refused with `Not allowed!` and an HTTP 500 - even
+    though it is the instance that shows you the tree you want to edit. The writable
+    one is `componentDocumentInstance`, and the content goes under the
+    `component-internal` node in its `node/component/<id>` key. `component-root`
+    looks like the obvious parent and accepts no children at all.
+
+4.  **An instance's node type carries the component's ID.** Not
+    `type: "component-instance"` but `type: "component-instance/<componentID>"` -
+    `ComponentInstanceElementTypeFactory` splits on that slash, which is why a bare
+    one fatals: there is no id for `$flags[0]` to read.
+
+Every step below is asserted against the row that came back or the HTML the site
+served, and the run ends by placing two instances and counting the component's own
+text in the delivered page - because one instance rendering proves less than two.
+"""
+from __future__ import annotations
+
+import argparse
+import csv
+import json
+import os
+import sys
+import time
+import urllib.error
+import urllib.request
+import uuid
+
+sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+from build_page import Surface, flatten  # noqa: E402
+from build_site import bind_page, build_shell  # noqa: E402
+from sweep_node_types import Client, envelopes, exceptions_of, unwrap  # noqa: E402
+
+MARKER = "COMPONENT PROBE — REUSED"
+
+
+def card(attr):
+    """What the component contains. Deliberately something with a border and a
+    string, so both the CSS and the text can be looked for in the delivered page."""
+    return {"type": "div", "data": {"attrID": attr},
+            "style": {"&": {"_": {"paddingTop": "18px", "paddingBottom": "18px",
+                                  "paddingLeft": "20px", "paddingRight": "20px",
+                                  "customStyles":
+                                      "border:1px solid rgb(214,214,206);"}}},
+            "children": [
+                {"type": "text",
+                 "data": {"tagName": "p", "attrID": attr + "-t"},
+                 "style": {"&": {"_": {"fontSize": "13px",
+                                       "letterSpacing": "0.16em"}}},
+                 "text": MARKER}]}
+
+
+def fetch(url):
+    sep = "&" if "?" in url else "?"
+    req = urllib.request.Request(
+        "%s%s_v=%d" % (url, sep, int(time.time() * 1000)),
+        headers={"User-Agent": "Mozilla/5.0", "Cache-Control": "no-cache"})
+    try:
+        with urllib.request.urlopen(req, timeout=90) as r:
+            return r.read().decode("utf-8", "replace")
+    except urllib.error.HTTPError as e:
+        return e.read().decode("utf-8", "replace")
+
+
+def main():
+    ap = argparse.ArgumentParser()
+    ap.add_argument("--config", required=True)
+    ap.add_argument("--post", type=int, required=True)
+    ap.add_argument("--slug", required=True)
+    ap.add_argument("--csv")
+    a = ap.parse_args()
+
+    cfg = json.load(open(a.config, encoding="utf-8"))
+    client, surface = Client(cfg), Surface()
+    rows, failed = [], 0
+
+    def step(name, ok, detail):
+        nonlocal failed
+        rows.append([name, "PASS" if ok else "FAIL", detail])
+        print("  %-28s %-5s %s" % (name, "PASS" if ok else "FAIL", detail))
+        if not ok:
+            failed += 1
+
+    # ── 1. the categories a component may hang from ──────────────────────────
+    inst = unwrap(client.get("adminComponentsEditorInstance"),
+                  "adminComponentsEditorInstance")
+    cats = inst.get("componentCategory") or []
+    step("categories exist", bool(cats),
+         ", ".join((r.get("data") or {}).get("name", "?") for r in cats)
+         or "none - a component has nothing to hang from")
+    if not cats:
+        sys.exit(1)
+
+    # ── 2. creating one, correctly parented ──────────────────────────────────
+    cid = str(uuid.uuid4())
+    resp = client.commit("adminComponentsEditorInstance", envelopes(inst),
+                         {"component": [{"newRevisionRecord": {
+                             "ID": cid, "parentType": "componentCategory",
+                             "parentID": cats[0]["ID"], "ordering": "a0",
+                             "status": "publish", "revision": "", "version": "",
+                             "name": "Probe Card", "path": ""},
+                             "originalRevisionRecord": None}]})
+    err = exceptions_of(resp)
+    inst2 = unwrap(client.get("adminComponentsEditorInstance"),
+                   "adminComponentsEditorInstance")
+    mine = [r for r in (inst2.get("component") or []) if r["ID"] == cid]
+    step("component created", bool(mine) and not err,
+         "parented to %r" % (cats[0].get("data") or {}).get("name")
+         if mine else "rejected: %s" % (err or "row never appeared"))
+
+    # ── 3. the document heals on first read ──────────────────────────────────
+    instance = "componentDocumentInstance/%s" % cid
+    first = client.get(instance)
+    doc = unwrap(client.get(instance), "componentDocumentInstance")
+    ckey = "node/component/%s" % cid
+    internal = next((n for n in doc.get(ckey, [])
+                     if n["type"] == "component-internal"), None)
+    step("document healed", internal is not None,
+         "first GET %s, second gave component-internal"
+         % ("404'd" if "_httperror" in first else "succeeded"))
+    if internal is None:
+        sys.exit(1)
+
+    # ── 4. content goes under component-internal, via the WRITABLE instance ──
+    recs = flatten(card("cmp-card"), internal["ID"], cid, surface, False,
+                   parent_type="component-internal")
+    for r in recs:
+        r["documentType"], r["documentID"] = "component", cid
+    resp = client.commit(instance, envelopes(doc),
+                         {ckey: [{"newRevisionRecord": r,
+                                  "originalRevisionRecord": None} for r in recs]})
+    err = exceptions_of(resp)
+    doc2 = unwrap(client.get(instance), "componentDocumentInstance")
+    types = sorted({n["type"] for n in doc2.get(ckey, [])})
+    step("component filled", "div" in types and not err,
+         "tree is %s" % ", ".join(types))
+
+    # ── 5. the read-only instance refuses the same write ─────────────────────
+    # A negative control: this is the endpoint that LOOKS like the right one, and
+    # the difference between the two is not visible from the route list.
+    ro = "componentNodeEditorInstance/%s" % cid
+    rodoc = unwrap(client.get(ro), "componentNodeEditorInstance")
+    ro_resp = client.commit(ro, envelopes(rodoc), {ckey: [
+        {"newRevisionRecord": dict(recs[0], ID=str(uuid.uuid4())),
+         "originalRevisionRecord": None}]})
+    refused = "_httperror" in ro_resp or bool(exceptions_of(ro_resp))
+    step("read-only instance refuses", refused,
+         "componentNodeEditorInstance rejected the same commit"
+         if refused else "it ACCEPTED a write it documents as not allowed")
+
+    # ── 6. two instances on a real page, and the page must show both ─────────
+    master = build_shell(client, cfg, {"pages": [], "shell": {}}, surface)
+    template = bind_page(client, cfg, master, a.slug, a.post)
+    tinst = "templateDocumentInstance/%s/%s" % (master, template)
+    tdoc = unwrap(client.get(tinst), "templateDocumentInstance")
+    tkey = "node/template/%s" % template
+    root = next(n for n in tdoc[tkey] if n["type"] == "template-internal")
+    base = {"parentType": "node", "parentID": root["ID"], "status": "publish",
+            "revision": "", "version": "", "documentType": "template",
+            "documentID": template}
+    place = [{"newRevisionRecord": dict(base, ID=str(uuid.uuid4()),
+                                        ordering="a%d" % i,
+                                        type="component-instance/%s" % cid,
+                                        data={"attrID": "cmp-use-%d" % i}),
+              "originalRevisionRecord": None} for i in range(2)]
+    resp = client.commit(tinst, envelopes(tdoc), {tkey: place})
+    err = exceptions_of(resp)
+    step("instances committed", not err, err or "type carries the component id")
+
+    html = fetch("%s/%s/" % (cfg["base"].rstrip("/"), a.slug))
+    ids = html.count('id="cmp-use-')
+    body = html.count(MARKER)
+    step("both instances rendered", ids == 2,
+         "%d instance elements in the delivered HTML" % ids)
+    step("component content reused", body == 2,
+         "the component's own text appears %d times from ONE definition" % body)
+
+    print("\n%d of %d checks passed" % (len(rows) - failed, len(rows)))
+    print("COMPONENT_ID=%s" % cid)
+    if a.csv:
+        with open(a.csv, "w", newline="", encoding="utf-8") as fh:
+            w = csv.writer(fh)
+            w.writerow(["step", "result", "detail"])
+            w.writerows(rows)
+        print("wrote", a.csv)
+    sys.exit(1 if failed else 0)
+
+
+if __name__ == "__main__":
+    main()