mosaic-headless 1.30.0 → 1.31.0

package/data/token-verification.csv

@@ -9,8 +9,8 @@ USED/--mk-accent,PASS,"5 element(s), e.g. mk-progress-track, mk-progress, mk-clo
 USED/--mk-accent-ink,PASS,"2 element(s), e.g. mk-header-cta, tk-chip-mk-accent-ink"
 USED/--mk-ai,PASS,"1 element(s), e.g. tk-chip-mk-ai"
 USED/--mk-faint,PASS,"1 element(s), e.g. tk-chip-mk-faint"
-USED/--mk-ink,PASS,"76 element(s), e.g. mk-clock-m, mk-clock-m, mk-clock-s"
+USED/--mk-ink,PASS,"66 element(s), e.g. mk-clock-m, mk-clock-m, mk-clock-s"
 USED/--mk-muted,PASS,"1 element(s), e.g. tk-chip-mk-muted"
 USED/--mk-panel,PASS,"3 element(s), e.g. tk-sw, tk-chip-mk-panel, tk-props"
-USED/--mk-paper,PASS,"7 element(s), e.g. tk-head, tk-chip-mk-paper, tk-pipe"
+USED/--mk-paper,PASS,"9 element(s), e.g. mk-cap-g0-menu, mk-cap-g1-menu, tk-head"
 USED/--mk-rule,PASS,"1 element(s), e.g. tk-chip-mk-rule"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mosaic-headless",
-  "version": "1.30.0",
+  "version": "1.31.0",
   "description": "AI-agent skill: build Mosaic Pro (Nextend) WordPress sites by writing the underlying data model directly - 23 custom tables, no visual editor, no DOM. Every node type, style property and node property swept against a live install and asserted on the delivered HTML and compiled CSS. Installs into Claude Code, Cursor, Codex CLI, Gemini CLI, Copilot, Continue, Windsurf and Claude.ai.",
   "keywords": [
     "wordpress",
@@ -33,6 +33,7 @@
     "scripts/",
     "assets/",
     "data/*.csv",
+    "data/browser-verification/*.csv",
     "references/",
     "sites/_moksa.py",
     "sites/_components.py",
@@ -41,6 +42,7 @@
     "sites/_dialogs.py",
     "sites/_dynamic.py",
     "sites/_forms.py",
+    "sites/_popovers.py",
     "sites/_sliders.py",
     "sites/_tokens.py",
     "tools/*.py",

package/references/dialog-and-triggers.md

@@ -1,12 +1,64 @@
-# Modal, OpenStreetMap, the new triggers and run rules (1.0.9), measured
+# Modal, popover, OpenStreetMap, the triggers and run rules (1.0.9, 1.0.10), measured
 
 1.0.9 is the first release since this skill began that adds *features* rather than
 renaming things: four node types, three interaction triggers, a rule engine that
 decides whether a trigger is allowed to run, two memory actions, and a shorthand
 that collapses "open this modal when …" into one object.
 
+1.0.10 adds the other half: `popover`, a dialog surface that does not block the
+page, and it moves the modal onto the same browser API. Both are measured below -
+the 1.0.10 changes to the modal first, because they overturn three things this page
+used to say, then the popover in full.
+
 Everything below was built on the live site and read back out of the delivered page
-or out of the browser. `data/dialog-verification.csv`, 19 checks, all passing.
+or out of the browser. `data/dialog-verification.csv`, 19 checks, and
+`data/popover-verification.csv`, 37 checks, all passing on 1.0.10.
+
+## 1.0.10: the modal moved onto the Popover API
+
+The host is still a `<dialog>`, but it now carries `popover="manual"` and the
+controller opens it with `showPopover()`, so an open modal is in the browser's
+**top layer**. Measured with the same probe page on both versions:
+
+| | 1.0.9 | 1.0.10 |
+|---|---|---|
+| open modal in the top layer | no | **yes** |
+| `dialog.open` while showing | `true` | **`false`**, always |
+| visible state | `[open]` attribute | `:popover-open`, plus `data-mosaic-dialog-state="open"` |
+| closed state | `dialog:not([open]){display:none}` (UA) | `.m-modal:not(:popover-open){display:none !important}` |
+| controller | `el.mosaicDialog.close()` | **no `close()`** - `open()`, `requestClose()` (a Promise), `toggle()` |
+
+What each row costs you:
+
+- **Top layer means `z-index` no longer decides anything.** A 1.0.10 modal paints
+  above a fixed header, a sticky bar, anything - whatever z-index those carry.
+- **Anything that tested `dialog.open` now reads every modal as closed.** Read
+  `el.matches(':popover-open')`. The dialog lab's verifier had exactly this bug on
+  the upgrade: it decided the page-load notice was shut, never dismissed it, and
+  18 of 33 checks failed behind its overlay. `tools/verify_dialog*.py` read either
+  signal now, so they hold on both versions.
+- **To close one from script, `el.mosaicDialog.requestClose()`.** `close()` throws
+  on 1.0.10 ("is not a function"); `hidePopover()` bypasses the controller.
+- **`display` on the host is safe now.** The closed state is `!important`, so an
+  author's `display:flex` can no longer pin a modal open - the trap the "five forms"
+  section below was built around. Measured: a modal whose host sets
+  `display:flex; align-items:center; justify-content:center` computes `display:none`
+  and 0x0 while closed, and `display:flex` with a centred window when open
+  (`FLEXMODAL/*` in `data/popover-verification.csv`). Positioning the window, as
+  the forms below do, still works on both versions.
+- **The window keeps Mosaic's default card look** - `border-radius:8px` and a
+  three-layer shadow on `:where(.m-modal-window)`. Zero-specificity, so any author
+  value wins, but a square-edged site that restyles the border and forgets the
+  radius gets rounded corners on a full-screen takeover and an edge-docked sheet.
+  Set `border-radius:0` with the border.
+
+**`scrollDepth` renamed its action slot.** It used to have one generated slot named
+after the type, `scrollDepth`; 1.0.10 declares two, **`reached`** and **`returned`**
+(scrolled back above the threshold). The data upgrade moves stored actions from
+`scrollDepth` to `reached`, and `completedAfter: "scrollDepth"` with them. Write
+`actionSlots.reached` - a key the type no longer declares is never exported, so an
+action left under `scrollDepth` is stored and silently never runs. The
+`interactionShorthand` form is unaffected: it fills the slot at render.
 
 ## Modal — a real `<dialog>`
 
@@ -47,12 +99,13 @@ delivers
   Measured on a modal authored with no overlay: the delivered HTML contains
   `<div class="m-modal-overlay" tabindex="-1">`, the host carries
   `aria-modal="true"`, and a real wheel event over the page moves it 0px while the
-  same page scrolls 700px with nothing open. **There is no non-blocking modal in
-  1.0.9.** A corner notice that must not trap the reader has to be built from
-  ordinary nodes, not from `modal`.
+  same page scrolls 700px with nothing open. **There is no non-blocking modal.**
+  On 1.0.9 a corner notice that must not trap the reader had to be built from
+  ordinary nodes; on 1.0.10 it is a `popover` (below).
 - **`closedby` is `everything` | `clickOutside` | `esc` | `nothing`**, and it is
   emitted as `data-mosaic-modal-closedby`, NOT as the native `closedby` attribute —
-  Mosaic opens the host with `show()`, where the native light-dismiss does not
+  Mosaic opens the host itself (`show()` on 1.0.9, `showPopover()` on a
+  `popover="manual"` host on 1.0.10), where the native light-dismiss does not
   apply, so its own controller reads the attribute. Measured: with `everything`,
   Esc closes it. `nothing` is the cookie-gate case, where the only way out is a
   `modalClose` action you place yourself.
@@ -281,6 +334,143 @@ anywhere. That is the skill's existing rule (`ValidatorDynamicCode` = bare strin
 `ValidatorDynamicCodeObject` = `{"v": …}`) applying to a new element, and it is also
 why those three can hold `@VAR('post/meta_lat')` and a custom field can drive the map.
 
+## Popover (1.0.10)
+
+A dialog surface that does **not** block the page: a menu, an info card, a tip, a
+notice, a tour step. It appears next to whatever opened it, next to an element you
+name, or in a fixed cell of the viewport, and the visitor can keep using everything
+else while it is open. `data/popover-verification.csv` (37 checks, all passing) is
+the popover lab, `/popovers/` on the demo site, built from `sites/_popovers.py`.
+
+```json
+{"type": "popover", "nodeID": "<uuid you mint>",
+ "data": {"accessibleLabel": "服務項目", "role": "menu", "closedby": "everything",
+          "positioning": {"type": "element",
+                          "elementOptions": {"side": "block-end", "align": "start",
+                                             "keepInView": "1"}}},
+ "children": [ … anything … ]}
+```
+
+delivers
+
+```html
+<div class="m-popover M_Dialog M_IJ _x" id="pp-menu" popover="manual" role="menu"
+     aria-label="服務項目" data-mosaic-popover-closedby="everything"
+     data-mosaic-popover-placement="block-end start"
+     data-mosaic-popover-keep-in-view="1"> … </div>
+```
+
+- **It has no required children.** Unlike `modal` there is no window and no
+  overlay - and that is the point: no overlay, nothing blocking, no `aria-modal`.
+  Measured with a page-load popover showing: the centre of the viewport hit-tests to
+  the page, a wheel event scrolls it 600px, and a button elsewhere on the page opens
+  a second popover while the first stays up. It may sit anywhere (`placement-rules`
+  says `any`), and dialogs may nest inside each other.
+- **`closedby` defaults to `nothing`.** A popover expects an explicit close: a
+  `popoverClose` / `popoverToggle` action, usually a button inside it. Measured:
+  `nothing` ignores Esc; `clickOutside` ignores Esc and closes on an outside click;
+  `everything` closes on both.
+- **`role` has no default** (dialog / menu / listbox / tooltip are the suggested
+  values); **`ariaLive`** is `off` | `polite` | `assertive` and is emitted only when
+  it announces; **`accessibleLabel`** always emits `aria-label`, as on the modal.
+- **The default look is a card**: white, `border-radius:8px`, shadow, `padding:24px`,
+  `max-width:384px`, `display:flex; flex-direction:column; row-gap:8px` while open -
+  all on `:where()`, so any style you set wins. The closed state is
+  `display:none !important`, so `display` on a popover is safe too.
+
+### Where it sits: `positioning`
+
+One group, `type` plus that type's options. Both option groups always exist in the
+schema; only the chosen one is read.
+
+| `type` | options | what it does |
+|---|---|---|
+| `screen` (default) | `screenOptions.position`: `top-left` … `bottom-right`, nine cells; default `bottom-right` | pure CSS, right in the first painted frame, no JavaScript. Physical directions: a viewport corner stays that corner in RTL |
+| `element` | `elementOptions.side`: `block-start` / `block-end` / `inline-start` / `inline-end` (default `block-end`); `align`: `start` / `center` / `end` (default `center`); `keepInView`: `"1"` / `"0"` (default `"0"`); `anchor`: a target (`{"type": "element", "uuid": "<node id>"}`, or a class / variant) plus optional `anchorModifiers` | positioned with native CSS anchor positioning. Logical directions, so RTL mirrors them. **No anchor means "whatever opened it"** |
+
+Measured, in Chromium at 1280x900:
+
+- an unanchored menu sits on its trigger's block-end edge, start-aligned, to the
+  pixel - and with `keepInView` it flips above when the 404px menu would not fit
+  below;
+- an anchor set to another element's node id puts the popover on THAT element
+  (bottom edge on the card's top edge, centres within 1px), whatever opened it;
+- all nine screen cells dock where their names say.
+
+**`keepInView` is the flip, and `___popover--flipped` is how it looks flipped.**
+With `keepInView: "1"` and no room on the requested side, the popover moves to the
+opposite side and carries `data-mosaic-popover-flipped`; the style state
+`___popover--flipped` (selector
+`&:where(.m-popover[data-mosaic-popover-flipped],.m-popover[data-mosaic-popover-flipped] &)`)
+applies to it and everything inside it. Two measured surprises:
+
+- **`keepInView: "0"` does not overflow.** Asked for `inline-end` with no room on
+  the right, the popover did not run off-screen - the browser shifted it back inside
+  the viewport, **on top of its own trigger** (popover 1020-1280px, trigger
+  1080-1231px). If covering the trigger is wrong, keepInView is not optional.
+- **On a phone, neither side may fit, and then nothing flips.** At 390px both
+  `inline-*` sides are too narrow for a 260px card: `flip` is armed, `flipped` never
+  set, and the card covers the trigger. Anchor to `block-start` / `block-end` for
+  anything that has to work at phone width.
+
+**A screen popover is glued to the viewport edge.** Mosaic places it with `inset:0`
+plus auto margins, zeroing the margin on the docked side, so `bottom-left` touches
+the bottom-left corner exactly. `top/right/bottom/left: 12px` on the popover moves
+every edge in at once and keeps the cell.
+
+### Opening and closing: three actions, one trigger
+
+Actions, aimed at the popover's **node id** like the modal's:
+`popoverOpen`, `popoverClose`, `popoverToggle`. The popover's
+`interactionShorthand` action is `popoverOpen`, so `{"type": "pageLoad", …}` on the
+popover itself is a self-opening notice (with run rules, exactly as on a modal).
+
+A new trigger, **`popover`** ("Popover visibility change", group Element events),
+goes ON the popover and has three slots: **`show`**, **`beforeClose`** (the native
+hide waits for it to finish), **`afterClose`** (the popover is already hidden):
+
+```json
+"interactions": [{"type": "popover", "uuid": "<uuid>",
+                  "popoverOptions": {"name": "tour-1", "ID": "<uuid>",
+                                     "actionSlots": {"afterClose": {"actions": [
+                                         {"type": "popoverOpen", "uuid": "<uuid>",
+                                          "settings": {"target": {"type": "element",
+                                                                  "uuid": "<next step>"}}}]}}}}]
+```
+
+### Two runtime rules that decide how a sequence has to be built
+
+Found by building a three-step tour whose "next" button did nothing:
+
+1. **A dialog opened by a trigger inside another dialog becomes its child, and a
+   parent closing closes its children.** The controller takes the dialog the
+   trigger sits in as the parent. So a "next" button inside step 1 that runs
+   `popoverOpen step 2` + `popoverClose step 1` opens step 2 as step 1's child and
+   closes both: measured, nothing open 200ms later.
+2. **Closing a popover suspends the interactions of every element inside it.** So
+   with the order reversed - close first, then open - the open never runs at all.
+
+The sequence therefore has to be advanced by **`afterClose`**: it runs once the step
+is already closed, so the step it opens has no open parent to be taken down with.
+The "next" button only closes its own step. And because afterClose fires on EVERY
+close, Esc included, a step that should be leavable must not take Esc
+(`closedby: "nothing"`); leaving is a button that runs `interactionSuspend` on the
+step first (its own afterClose then does not run) and then `popoverClose`. The
+start button runs `interactionResume` on each step before opening the first, so a
+tour ended halfway can be started again. Measured: start > next > next > done walks
+step 1 > 2 > 3 > the closing card; "end" on step 2 leaves nothing open; a restart
+advances normally; Esc on a step leaves it open.
+
+`interactionSuspend` / `interactionResume` take a `target` and an optional
+`settings.interactionID`; with none, every interaction on the target.
+
+### The modal, flex-centred
+
+The lab's last demo is the 1.0.10 modal change made visible: a modal whose host is
+`display:flex` + centred, which on 1.0.9 would have pinned it open. It hides when
+closed and centres its window when open, and it sits in the top layer above the
+fixed header.
+
 ## The rest of 1.0.9, briefly
 
 Not everything in the release is a node you place. Four things that change how the
@@ -387,7 +577,7 @@ own `interactionShorthand`, a page's popup policy is one object in that page's d
 Nothing else on the page changes, no trigger element is placed, and two pages of the
 same site can behave completely differently without sharing anything.
 
-## Five forms out of three nodes — and the one property you must not set
+## Five forms out of three nodes — and, on 1.0.9, the one property you must not set
 
 "A modal" in most builders means one centred card, because the builder owns the
 chrome. Mosaic owns none of it: `.m-modal` is a `position:fixed; inset:0` layer
@@ -395,7 +585,8 @@ with `pointer-events:none`, `.m-modal-overlay` is a second fixed layer that take
 pointer events back, and `.m-modal-window` is an ordinary child of the first. The
 form is decided by where the window is pinned inside that layer.
 
-**Never set `display` on the `modal` host.** A `<dialog>`'s open/closed visibility
+**On 1.0.9, never set `display` on the `modal` host** (1.0.10 made it safe - see
+the top of this page). A `<dialog>`'s open/closed visibility
 *is* its display property — the UA stylesheet hides it with
 `dialog:not([open]) { display: none }` — so an author-level `display:flex` on the
 host wins the cascade and every modal on the page is permanently on screen. It is

package/references/dynamic-content.md

@@ -165,3 +165,22 @@ half and the output ends in U+FFFD. Lengths have to be a multiple of the encodin
 width — 18 for six three-byte characters — or the truncation has to be left to CSS.
 A count-based check cannot see this; `verify_components.py` looks for the
 replacement character directly.
+
+## Date conditions (1.0.10)
+
+The `date` comparator - element and form-action server conditions, and the post /
+user loop filters - has four operators now: `after`, `after-or-equal`, `before`,
+`before-or-equal` (1.0.9 had the first and third). The value is any text, read by
+`DateComparison` when it compares rather than validated when it is saved:
+
+- a year first: `2026-09-24`, `2026/9/24`, `2026-09`, `2026`;
+- a year last: `28/09/2026`, `9-28-2026` - a number above 12 is the day; when both
+  could be, the **site's date format** decides which comes first;
+- `Ymd` (ACF's date picker storage) and `YmdHis`; any shorter digit run is a Unix
+  timestamp in the site timezone;
+- a time after the date or on its own (`09:16`, `9:16 pm`), with an optional zone.
+
+The less precise side sets the precision: a date against a date-time compares the
+two days. Whatever cannot be read as a date matches **no** operator, so a typo is a
+condition that is never true rather than an error. Loop filters compare in SQL
+(`post_date_gmt` / `post_modified_gmt` as UTC, the others as the site's wall clock).

package/references/failure-modes.md

@@ -319,7 +319,12 @@ The general shape, worth carrying beyond this repo: a derived artifact checked i
 the tree is only as fresh as the last time someone re-derived it, and if the deriving
 input is not in the tree, no amount of CI will notice.
 
-## Setting `display` on a `<dialog>` pins it open, and open-state checks cannot see it
+## Setting `display` on a `<dialog>` pins it open, and open-state checks cannot see it (1.0.9)
+
+**Fixed in 1.0.10**: the closed modal is `.m-modal:not(:popover-open){display:none !important}`,
+which no author `display` beats - measured, a flex-centred modal host hides when closed
+(`references/dialog-and-triggers.md`). Everything below is the 1.0.9 behaviour, and still
+the reason the checks it produced exist.
 
 The modal host is a `<dialog>`. Its open/closed visibility is not a class or an
 attribute Mosaic manages — it is the UA stylesheet rule
@@ -340,7 +345,8 @@ Two rules come out of it:
   edges inside the fixed, `inset:0` host), never by making the host a flex or grid
   container.
 - **Assert the closed state.** `tools/verify_dialog_lab.py` now closes everything
-  first and fails if any `dialog:not([open])` still has a box. The general form of
+  first and fails if any closed modal (not `:popover-open` and not `[open]`) still
+  has a box. The general form of
   that lesson: for anything with a visible and an invisible state, a suite that
   only exercises the visible one is testing half a component, and the half it
   skips is the one the visitor sees most of the time.
@@ -402,8 +408,9 @@ labels and that an empty required form is actually refused.
 
 ## `display` on an element whose visibility the plugin owns — twice now
 
-A `<dialog>`'s open state is its `display`, so `display:flex` on a modal host pins
-every modal open. The same mistake, in a different family: `multi-steps-form-step`
+On 1.0.9 a `<dialog>`'s open state was its `display`, so `display:flex` on a modal host
+pinned every modal open (1.0.10 made the closed state `!important`). The same mistake,
+in a family 1.0.10 did not touch: `multi-steps-form-step`
 is shown and hidden by the plugin moving `m-form-step--active`, and a `display:flex`
 on the step wins the cascade, so all three steps sit on the page at once with three
 sets of Next buttons.
@@ -444,3 +451,28 @@ On a theme that cannot use the variant layer, a `code` node with
 verbatim**: it does not wrap anything, so the `<style>` tags are yours to write.
 Without them the rule lands in `<head>` as bare text between `</style>` and
 `</head>`, renders nothing, and reads as a CSS specificity problem.
+
+## A "next" button inside a popover cannot open the next popover
+
+Measured on 1.0.10, building a three-step tour: the button in step 1 ran
+`popoverOpen` (step 2) and `popoverClose` (step 1), and nothing was open 200ms later.
+Two runtime rules combine:
+
+- a dialog opened by a trigger that sits inside another dialog becomes that dialog's
+  CHILD, and closing a parent closes its children - step 2 went down with step 1;
+- closing a popover suspends the interactions of every element inside it - with the
+  actions reversed, the `popoverOpen` after the close never ran.
+
+Advance a sequence on the step's own `afterClose` (it runs after the close, with no
+open parent left), make the button close only its own step, and remember afterClose
+also fires on Esc. The full pattern is in `references/dialog-and-triggers.md`.
+
+## A plugin folder swapped in by hand serves every asset as 406
+
+Installing 1.0.10 by unzipping it next to the old folder and renaming: the zip's
+directories came out `drwx------`, the web server could not traverse them, and every
+`public/Frontend/*.js` and the theme `style.css` answered **406**. The page still
+rendered - server-side output was fine - but with no front-end runtime every dropdown
+sat open and no modal could open. `find mosaic -type d -exec chmod 775 {} +` (files
+664), matching the other plugin folders, and purge the page cache. A REST-level check
+cannot see this; only fetching an asset can.

package/references/styling.md

@@ -227,3 +227,12 @@ Both of these are refused at build time by `build_page.py` rather than silently
 dropped, which is the only reason they cost minutes instead of a debugging session
 — a property that is not in the registry cannot be set at all, and Mosaic's own
 API accepts the write and discards it.
+
+## Gradient stops take units (1.0.10)
+
+A gradient's `dots[].position` - background and mask alike - used to be a bare float
+0-100. 1.0.10 validates it as a length-percentage: `"50%"`, `"120px"`, a `calc()`, or a
+collection variable, with `%` as the fallback unit and 0-100 enforced only on
+percentages. A bare number still validates (it is read as a percentage), but the
+values Mosaic itself now writes are strings with a unit - the built-in background
+collection's stops changed from `10` / `50` to `"10%"` / `"50%"`.

package/references/upgrading.md

@@ -1,4 +1,4 @@
-# Upgrading the plugin: what 1.0.7 → 1.0.8 did to the data, measured
+# Upgrading the plugin: what 1.0.7 → 1.0.8 → 1.0.10 did to the data, measured
 
 A Mosaic plugin update is two events, not one. The files change when WordPress
 installs the package; the DATA changes only when Mosaic's own upgrade flow has
@@ -180,3 +180,48 @@ The order that worked, and why each step is there:
    five-minute upstream limit during `createTemplates`; at 25 masters and 8,608
    nodes it finished in under two minutes and `theme_zip_compare.php` passed
    22 of 22, the four renamed tables included.
+
+## 1.0.9 → 1.0.10
+
+**Getting the package.** The update shows in wp-admin, but its package is
+`private-mosaic-pro://releases/stable/Mosaic-pro-plugin-stable-1.0.10.zip`, which
+`wp plugin update mosaic` could not fetch on an unlicensed install ("No plugins
+updated (1 failed)", and a second run claiming "already updated" while the version
+still read 1.0.9). Two downloads labelled as the new release were 1.0.9 byte for
+byte - one only the inner `Mosaic/` namespace folder. **Check `Version:` in
+`mosaic.php` before installing anything**, and diff the tree against the old one: a
+real 1.0.10 has `Mosaic/NodeTypes/Popover/`. The real package unpacked to a folder
+named `mosaic-next/`; it is installed by renaming it to `mosaic` in place of the old
+folder, then **chmod** (directories 775, files 664 - the zip's `drwx------` served
+every asset as 406), then `tools/data_upgrade.py`, whose six milestones took about
+seven minutes on this theme.
+
+**What the migration rewrote.** One thing: scroll-depth interactions. The type
+used to have a single generated action slot named after itself, `scrollDepth`; it
+now declares `reached` and `returned`, and the migration moves stored actions (and
+a `completedAfter: "scrollDepth"`) to `reached` across `mosaic_nodes` and the four
+class tables. No table changed shape (`Schema-1.0.10.php` lists the same tables).
+
+**What changed in the delivered page.** The modal host gained `popover="manual"`
+and opens into the top layer; `dialog.open` is always false and the controller has
+`requestClose()` instead of `close()`. Every tool that decided "is it open?" from
+`dialog.open` read every modal as closed afterwards - the dialog lab reported 18 of
+33 failures that were all the verifier's. `references/dialog-and-triggers.md` has
+the measured table.
+
+**Re-extracted from the 1.0.10 source and diffed against 1.0.9:** one node type
+(`popover`, 129), five node properties (196), one data class (126), one placement
+rule (129), one style state (`___popover--flipped`, 54), one interaction trigger
+(`popover`, 16), twelve pluggable IDs (261 - the three popover actions and their
+groups, the trigger and its slots, scroll depth's two new slots), the date
+comparator's operators (`after-or-equal`, `before-or-equal`) and gradient stop
+positions accepting units (`references/styling.md`). The 115 editor routes are the
+same 115. Every demo verifier was re-run on the result and passes; the full node
+sweep was run for the types 1.0.10 added or that had never been swept
+(`popover`, `fieldset-legend`, `fieldset-content`, all RENDERED), the other rows
+are the 1.0.9 sweep.
+
+**The sweep had stopped measuring anything, and nothing said so.** It read `/`,
+which stopped being the post archive when the site got a static front page; every
+type, a plain `div` included, came back COMMITTED. It now reads `sweepPath`
+(default `?post_type=post`) and refuses to run unless a plain div renders there.

package/scripts/check-release.mjs

@@ -26,9 +26,37 @@ import { fileURLToPath } from "node:url";
 
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 const read = (p) => fs.readFileSync(path.join(ROOT, p), "utf8");
+// A table split one file per page (data/browser-verification/) is still one table:
+// its CSVs, in name order, each with its own header.
+const tableFiles = (p) => fs.statSync(path.join(ROOT, p)).isDirectory()
+  ? fs.readdirSync(path.join(ROOT, p)).filter((f) => f.endsWith(".csv")).sort()
+      .map((f) => `${p}/${f}`)
+  : [p];
 const problems = [];
 const fail = (m) => problems.push(m);
 
+// ---------- the plugin directory's limits -----------------------------------
+//
+// The Claude plugin directory reads the repository root, every tracked file of it,
+// and holds a submission for a reviewer when any file that is not an image or font
+// is over 256 KiB, or when there are more than 512 files. A 400 KB CSV and a 2 MB
+// generated site file did exactly that. Checked here, so it fails on this machine
+// rather than in a review queue a week later.
+try {
+  const tracked = execSync("git ls-files -z", { cwd: ROOT }).toString().split("\0").filter(Boolean);
+  if (tracked.length > 512) fail(`${tracked.length} tracked files - the plugin directory allows 512`);
+  for (const f of tracked) {
+    if (/\.(png|jpe?g|gif|webp|svg|ico|woff2?|ttf|otf)$/i.test(f)) continue;
+    const full = path.join(ROOT, f);
+    if (!fs.existsSync(full)) continue;
+    const size = fs.statSync(full).size;
+    if (size > 256 * 1024)
+      fail(`${f} is ${(size / 1024).toFixed(0)} KiB - the plugin directory holds any non-image file over 256 KiB`);
+  }
+} catch {
+  // not a git checkout (an unpacked tarball): nothing to measure against
+}
+
 // ---------- versions agree --------------------------------------------------
 
 const pkg = JSON.parse(read("package.json"));
@@ -91,28 +119,30 @@ if (!fs.existsSync(path.join(ROOT, pkg.bin["mosaic-headless"])))
 
 // ---------- the numbers in the docs are counted, not trusted ----------------
 
-const rows = (p) => read(p).trim().split("\n").length - 1;   // minus the header
+const rows = (p) => tableFiles(p)
+  .reduce((n, f) => n + read(f).trim().split("\n").length - 1, 0);   // minus each header
 const counts = {
-  "data/node-verification.csv": 126,
+  "data/node-verification.csv": 129,
   "data/style-verification.csv": 98,
   "data/node-property-verification.csv": 191,
   "data/rwd-verification.csv": 733,
-  "data/browser-verification.csv": 4132,
+  "data/browser-verification": 4132,
   "data/style-state-verification.csv": 52,
   "data/interaction-verification.csv": 7,
-  "data/data-class-hierarchy.csv": 125,
+  "data/data-class-hierarchy.csv": 126,
   "data/custom-fields-verification.csv": 62,
   "data/dialog-verification.csv": 19,
   "data/slider-verification.csv": 30,
   "data/token-verification.csv": 15,
-  "data/mobile-audit.csv": 65,
+  "data/mobile-audit.csv": 68,
   "data/component-wall-verification.csv": 26,
-  "data/form-surface-verification.csv": 15,
-  "data/content-loop-verification.csv": 12,
-  "data/navigation-verification.csv": 36,
+  "data/form-surface-verification.csv": 18,
+  "data/content-loop-verification.csv": 15,
+  "data/navigation-verification.csv": 39,
   "data/page-modal-verification.csv": 19,
   "data/interaction-rules-verification.csv": 17,
   "data/dialog-form-verification.csv": 49,
+  "data/popover-verification.csv": 37,
   "data/value-coercion-verification.csv": 12,
 };
 for (const [file, expected] of Object.entries(counts)) {
@@ -131,7 +161,7 @@ if (!style.includes("SKIPPED")) fail("style-verification.csv has no SKIPPED rows
 
 // The browser pass has the same obligation, under a different word: a declaration it
 // cannot soundly compare must say so rather than be counted as agreement.
-const browser = read("data/browser-verification.csv");
+const browser = tableFiles("data/browser-verification").map(read).join("\n");
 if (!browser.includes("not-comparable"))
   fail("browser-verification.csv has no not-comparable rows - a computed-value check "
      + "that claims to compare everything is comparing things it cannot");
@@ -190,13 +220,13 @@ if (/,FAIL,/.test(zip)) fail("data/theme-zip-verification.csv carries a failed c
 // rwd and browser counts, and must not carry the previous ones.
 {
   const fmt = (n) => n.toLocaleString("en-US");
-  const want = [rows("data/rwd-verification.csv"), rows("data/browser-verification.csv")];
+  const want = [rows("data/rwd-verification.csv"), rows("data/browser-verification")];
   for (const readme of ["README.md", "README.zh-TW.md", "README.ja.md", "README.ko.md"]) {
     const text = read(readme);
     for (const n of want)
       if (!text.includes(fmt(n)) && !text.includes(String(n)))
         fail(`${readme} does not quote ${fmt(n)} - it is quoting a stale count`);
-    if (/0 findings|指摘 0 件|지적 0건|0 項發現/.test(text))
+    if (/\b0 findings\b|指摘 0 件|지적 0건|0 項發現/.test(text))
       fail(`${readme} still claims a design audit with 0 findings`);
   }
 }

package/sites/_dialogs.py

@@ -139,6 +139,8 @@ def make_modal(key, num, title, lead, body, specs, host, window,
                  "paddingLeft": "30px", "paddingRight": "30px",
                  "customDeclarations": "border:1px solid rgb(22,24,28);"}
     win_style.update(window)
+    win_style["customDeclarations"] = (win_style.get("customDeclarations", "")
+                                       + "border-radius:0;")
 
     children = []
     if overlay:
@@ -210,9 +212,10 @@ def M(key, num, title, lead, body, specs, host, window, **kw):
 CENTRE_MODAL = M(
     "centre", 1, "置中對話框",
     "最直接的一種，也是其他八種的基準。",
-    "Mosaic 的 modal 是真正的 <dialog>，由外掛自己的控制器用 show() 開啟。"
-    "因為是 show() 而不是 showModal()，瀏覽器原生的 light-dismiss 不會生效，"
-    "所以關閉方式寫在 data-mosaic-modal-closedby 屬性上，由控制器讀取。"
+    "Mosaic 的 modal 是真正的 <dialog>，1.0.10 起帶 popover=\"manual\"，"
+    "由外掛自己的控制器用 showPopover() 開啟，進入瀏覽器的 top layer——"
+    "所以它一定蓋在固定 header 之上，z-index 管不到它。manual 代表瀏覽器不會自己關它，"
+    "關閉方式寫在 data-mosaic-modal-closedby 屬性上，由控制器讀取。"
     "另外 aria-modal=\"true\" 不是你寫的——它在 modal 帶有 overlay 子節點時才出現，"
     "因為真正擋住頁面的是 overlay。",
     [("觸發", "click → modalOpen"), ("執行規則", "無"), ("記憶", "無"),
@@ -225,8 +228,8 @@ SHEET_MODAL = M(
     "modal 這層是 position:fixed; inset:0 的全視窗圖層，pointer-events:none；"
     "modal-window 只是它的一個 flex 子元素。所以「抽屜」不是另一種元件，"
     "只是把 window 絕對定位到 left:0; right:0; bottom:0——沒有新的節點型別，也沒有自訂 CSS。"
-    "特別不能把 host 做成 flex 容器：<dialog> 是靠 display 決定開關的，"
-    "在 host 上寫 display 會讓所有彈窗永遠關不起來。"
+    "1.0.9 時 host 上不能寫 display——那會讓彈窗永遠關不起來；"
+    "1.0.10 把關閉狀態改成 display:none !important，這條限制消失了。"
     "手機上這是比置中卡片更合手的形態，拇指搆得到。",
     [("觸發", "click → modalOpen"), ("執行規則", "無"), ("記憶", "無"),
      ("關閉", "clickOutside（只有點遮罩）"), ("排版", "window: left/right/bottom = 0")],
@@ -261,7 +264,8 @@ TOAST_MODAL = M(
     "所以 aria-modal=\"true\" 實際上是拿不掉的，"
     "實測也確認：這個彈窗開著時，滑鼠滾輪同樣捲不動頁面。"
     "角落通知是一種排版，不是一種「不阻擋」的 modal——"
-    "1.0.9 沒有不阻擋的 modal。真正不擋人的通知要用普通節點做。",
+    "modal 沒有不阻擋的版本。1.0.10 起，真正不擋人的通知用 Popover 做——"
+    "浮動層頁的第五個示範就是同一張通知，換成 popover 之後頁面照樣能用。",
     [("觸發", "pageLoad（interactionShorthand）"), ("執行規則", "cap max 1"),
      ("記憶", "session（sessionStorage，每個分頁各自計算）"),
      ("關閉", "everything"),
@@ -272,6 +276,8 @@ TOAST_MODAL = M(
      "paddingLeft": "20px", "paddingRight": "20px",
      "customDeclarations": "border:1px solid rgb(22,24,28);"
                            "box-shadow:0 18px 44px rgba(22,24,28,.18);"},
+    window_m={"top": "72px", "left": "0px", "right": "0px", "width": "auto",
+              "maxWidth": "none", "maxHeight": "calc(100% - 72px)"},
     shorthand={"type": "pageLoad",
                "pageLoadOptions": {"runs": {"rules": [
                    {"uuid": U(), "type": "cap",
@@ -350,6 +356,8 @@ DEPTH_MODAL = M(
      ("關閉", "clickOutside"), ("紀錄", "mos:v1:r:dl-depth")],
     {},
     {"left": "24px", "bottom": "24px", "maxWidth": "380px", "width": "100%"},
+    window_m={"left": "0px", "right": "0px", "bottom": "0px", "width": "auto",
+              "maxWidth": "none"},
     closedby="clickOutside",
     shorthand={"type": "scrollDepth",
                "scrollDepthOptions": {
@@ -559,8 +567,10 @@ NOTE = section("dl-note", [wrap("dl-note-w", [
               "Mosaic 沒有那層外殼——modal、modal-overlay、modal-window "
               "是三個可以自由排版的節點，所以上面九種形態全部來自同一組資料，"
               "差別只在 window 被釘在哪裡。順帶一個踩過的坑："
-              "host 不能設 display——<dialog> 是靠 display 決定開關的，"
-              "寫了 display:flex 就等於把每一個彈窗永遠打開。",
+              "在 1.0.9，host 不能設 display——<dialog> 是靠 display 決定開關的，"
+              "寫了 display:flex 就等於把每一個彈窗永遠打開。"
+              "1.0.10 把關閉狀態改成 display:none !important，這個坑填平了；"
+              "這裡的九種形態仍然用定位排版，好讓同一份資料在兩個版本都對。",
               fontFamily=CJK, fontSize="15px", lineHeight="1.95",
               color={"token": "--mk-ink"}, marginTop="16px", maxWidth="680px"),
             T("p",