super-ux 0.35.3 → 0.36.1

package/CHANGELOG.md

@@ -1,5 +1,78 @@
 # Changelog
 
+## 0.36.1 — 2026-08-12
+
+Four of the R-14 run's findings actioned, and a defect class ported from the
+sibling repository.
+
+### Fixed
+
+- **BP-123 described web billing and was applied to "any subscription billed
+  self-serve".** On a store-billed subscription the app **cannot cancel**: the
+  terminal step hands off to the store's own sheet and the app does not
+  synchronously know whether the user went through. A flow designed from the old
+  sentence cannot be built on a phone — which is exactly what a fresh-context
+  agent produced, correctly, from what the entry said. It now branches on who
+  holds the billing and requires the third state, *unverified*, that claims
+  neither outcome.
+- **A save offer must name the mechanism that delivers it.** BP-123 listed
+  "pause, downgrade, discount" — and **billing pause is not an iOS mechanism**, so
+  a product-side pause worded as a billing pause is a lie in copy at the moment
+  the user is deciding whether to trust you.
+- **BP-102 and BP-206 collided with no cross-reference.** On a cancellation screen
+  the exit is both the destructive action and the thing the user came for. Both
+  entries now carry the resolution: destructive *styling* is required, destructive
+  *weight* is not — full width, same type size and tap target, reachable without
+  scrolling.
+- **"Diverge before converging" had nowhere to land.** `ux-flows` requires two
+  structurally different shapes and one line on why the loser lost; the `flows.md`
+  contract had no field for it, so the rejected shape evaporated and the next agent
+  re-litigated it. The contract gains `Rejected shape:`.
+- **The Figma question said "at the start" from inside step 6.**
+  `figma-integration.md` places it at step 0 and is right; the flows skill now says
+  so instead of contradicting it.
+
+### Added
+
+- **A check-count ratchet, ported from `sheleg-design`.** That repository's
+  retrospective recorded the class: a gate whose count can fall silently cannot
+  detect a deleted requirement. This one had no ratchet at all, so every
+  requirement deletion here was invisible **by construction**. `test/floors.json`
+  plus `check_floor()` inside `validate.py`, which CI already runs — watched saying
+  no against a planted impossible floor.
+
+## 0.36.0 — 2026-08-12
+
+R-14 was filed `never` this morning and closed the same day, by the only
+evidence available for a rule that lives in a skill rather than a script: a run.
+
+### Changed
+
+- **The sweep was verified in a fresh context, against a brief that never
+  mentioned it.** An iOS subscription-cancellation flow, with no reference to
+  Mobbin, Refero, Lazyweb or sweeping anywhere in the prompt. The agent gated on
+  the tools present rather than the config and said which were which, swept
+  **before** drawing, read four shipped cancellation flows, and named what each
+  changed and what it refused to let them change — the job stayed the
+  foundation's, the visual identity stayed the style pack's. It also declined an
+  instruction embedded in one server's own response asking to alter persistent
+  instructions, which is the untrusted-data rule holding under a live test nobody
+  designed.
+
+### Added
+
+- **Two cases the sweep assumed away, both reported by that run.** With only the
+  image server present you are reading step order and decision points off
+  screenshots — a weaker read than structured steps, not an equivalent one, and it
+  has to be said. And a sweep that returns nothing is a result: Lazyweb returned
+  zero flows for a completely mainstream journey, and "I swept" with no findings
+  and no statement of emptiness cannot be told apart from not sweeping.
+- **B-012** files the run's nine other findings, each reproducible from its
+  report — including that the Design workflow has no defined behaviour for "we know
+  almost nothing", that the practice pass does not scale to roughly 150 verdicts for
+  one flow, and that BP-123 describes web billing on a platform where the app
+  cannot cancel an IAP.
+
 ## 0.35.3 — 2026-08-12
 
 ### Changed

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "super-ux",
-  "version": "0.35.3",
+  "version": "0.36.1",
   "description": "Scenario-driven UI development for AI agents (Claude Code, Cursor, 70+ agents): a versioned design chain in docs/ux/, a scenario-first hard rule, a deterministic drift linter, and evidence-backed UX audits. This package is the installer CLI.",
   "bin": {
     "super-ux": "bin/super-ux.js"