tosijs-floorplan 0.4.0 → 0.5.0

package/README.md

@@ -90,6 +90,7 @@ One flat record per wired element. Producers may add fields beyond these —
 | `contentEditable` | `boolean` | an editable region — treated as an input field |
 | `interactive` | `boolean` | the producer's **assertion** that this element can be acted on — for producers that cannot introspect handlers (React delegates at a root; vanilla `addEventListener` is not enumerable from page script). Asserting is truth-telling; fabricating `on` to unlock the styling would be a lie in the payload. A binding framework never needs it |
 | `editable` | `boolean` | the producer's assertion that text goes in here — the DOM-side counterpart of `contentEditable` / a two-way binding |
+| `secret` | `boolean` | the producer **withheld** facts about this element (a secret-marked region: a token lives in the destination, so neither `label` nor `href` is published). **Fail-closed on the renderer side**: a secret record's label/text/value/placeholder/href/**image** never reach the drawing or the legend even if a producer bug leaves them in the record, and any truthy `secret` scrubs (malformed errs toward withholding) — it draws `<tag> [withheld]` and its legend entry says `redacted: true` (structural records included) — "no destination" and "destination withheld" are different facts |
 | `on` | `Record<string, string \| string[]>` | handlers by event type — a path when nameable, `ƒ` (or `ƒ name`) when not |
 | `list` | `{path, idPath?}` | this element renders a collection (drawn as *ground*, not figure) |
 | `structural` | `boolean` | structure, not affordance (headings, landmarks, containers) |
@@ -120,14 +121,28 @@ content — MUST neutralize both tokens inside data at the source**, as
 tosijs ≥ 1.8.0 does. This is normative because of an honest residual: a
 forged arrow in *suffix* position on a bindable field (`"data ⟷ fake.path"`
 as the entire text) is structurally indistinguishable from a real binding —
-renderer-side defense ends where the format's own syntax begins.
+renderer-side defense ends where the format's own syntax begins. And the
+bindable set is **open by design** (bound props ride under their own keys),
+so the never-scanned list is a denylist over an open key set: any key a
+producer invents is bindable, and arrows in it are trusted as structure.
+The defense is narrowed, not closed — producer-side neutralization remains
+the actual perimeter (issue #11). The capability scan (below) likewise
+counts an arrow in **any position** within a bindable field: under the
+format's own last-occurrence parse, "contains an arrow" and "has a
+structural arrow" are equivalent for a lone token, so a position check
+would add no security — only the #11 perimeter does.
 
 **Producers that cannot introspect handlers** (React's synthetic delegation,
 Angular's compiler output, vanilla `addEventListener` — none enumerable from
 page script) assert the affordance instead: `interactive` / `editable`, per
 record. When a map draws affordance-shaped boxes but **no** record carries
-any evidence at all (no `on`, `href`, `contentEditable`, two-way binding, or
-assertion), the result carries a `note` — and the svg's `<desc>` repeats it —
+affordance evidence (no `on`, `href`, `contentEditable`, two-way binding, or
+assertion) **and none carries capability evidence either** — a handler, an
+assertion, or a provenance arrow in a bindable field *anywhere in the map*,
+display-only `⟵` included, proves the producer can see wiring (#10: a
+read-only dashboard from a binding framework is a sighted map of an inert
+page, not a blind map) — the result carries a `note`, and the svg's
+`<desc>` repeats it,
 because "nothing here is actionable" and "the producer couldn't tell" are
 different statements, and a consumer must never mistake the second for the
 first. Two caveats pin the semantics: **partial evidence does not establish
@@ -182,10 +197,22 @@ the text is (the text-only rule exempted exactly the header-row-of-icons
 case the check was built for; haltija's issue #2 caught it). A producer
 with DOM access computes the exception *properly* (computed display +
 parent text nodes) and ships the finding via `flags` — that is the
-**intended path** for DOM producers; a producer flag whose `kind` mentions
-`target` **supersedes** the built-in audit, so the two never double-mark.
-Both rules are exported (`isInteractive`, `targetSizeFinding`) so audits
-share this implementation instead of keeping a drifting copy.
+**intended path** for DOM producers. A producer flag whose `kind` is one
+of the **target-claim kinds** (`TARGET_FLAG_KINDS`, case-insensitive:
+`target`, `target-size`, `targetsize`, `target_size`, `smalltarget`)
+**supersedes** the drawn audit, so the two never double-mark — an explicit
+set, because a substring match let `target-ok` stand the audit down (#8);
+new target-claim kinds are added to `TARGET_FLAG_KINDS` via an issue here,
+the same additive path as any other format change, and the set is
+read-only by contract.
+Supersession is a *drawing* concern and therefore **opt-in**:
+`targetSizeFinding` ignores producer flags by default (an audit wants the
+geometry verdict regardless of what got drawn); `schematic()` passes
+`honorProducerFlags: true`. Hidden is not small: zero-size records are
+never undersized (#9). Both rules are exported (`isInteractive`,
+`targetSizeFinding`) so audits share this implementation instead of
+keeping a drifting copy — and as of 0.5.0 they reproduce an audit's
+verdicts without consumer-side normalization (#7/#8/#9/#13).
 
 Captions tell the truth in priority order: a held **value** wins (as
 `label: value` when both are known), an empty control falls back to its
@@ -202,7 +229,8 @@ geometry genuinely runs out.
 | `schematic(description, options?)` | the renderer's primary form — returns `{ svg, legend, note? }`: the drawing, the metadata it could not legibly carry (cramped/truncated/undersized records, keyed by index/ref), and — when no record carries affordance evidence — the note saying so. **Pair every raster with its legend.** |
 | `schematicSVG(description, options?)` | `schematic().svg` — the string-only form; each `<g>` carries `data-record="<i>"` linking back to `description.wiring[i]` (the image as index) |
 | `isInteractive(record)` | "can I act here?" — the single implementation (handlers, `href`, `contentEditable`, a structural two-way binding, or the producer's assertion; ground never). Exported so audits consume it instead of keeping a drifting copy |
-| `targetSizeFinding(record, targetSize?)` | the WCAG 2.5.8 rule with the settled exemptions (toggles, text-sized links, producer-flag supersession) — the measured legend fact, or `null` |
+| `targetSizeFinding(record, targetSize?, {honorProducerFlags?})` | the WCAG 2.5.8 rule with the settled exemptions (toggles, text-sized links, zero-size; producer-flag supersession only when honoured — the renderer's setting, not an audit's) — the measured legend fact, or `null` |
+| `TARGET_FLAG_KINDS` | the flag kinds that claim to *be* a target-size finding and may supersede the drawn audit |
 | `rasterizeSVG(svg, {scale})` | SVG → PNG Blob for vision encoders (browser canvas; under bun/node use `@resvg/resvg-js` — rasterize at 2× so labels OCR cleanly) |
 | `boundsOf(element)` | an element's page-coordinate bounds — the natural `within` argument |
 | `BOUND_TO_DOM`, `BOUND_TWO_WAY` | the provenance tokens |

package/dist/index.d.ts

@@ -93,6 +93,13 @@ export interface SchematicRecord {
     /** the producer's assertion that text goes in here — the DOM-side
      * counterpart of contentEditable/two-way bindings (issue #3) */
     editable?: boolean;
+    /** the producer WITHHELD facts about this element (tosijs 1.11.0's
+     * secret regions: a magic-link token lives in the href, so neither
+     * label nor href is published). Drawn with a `[withheld]` caption when
+     * nothing else names it, and the legend says redacted — "this link has
+     * no destination" and "its destination was withheld" are different
+     * facts (issue #15) */
+    secret?: boolean;
     [boundProp: string]: unknown;
 }
 /** the map: only `wiring` is read. The named optional fields are the
@@ -188,6 +195,9 @@ export interface SchematicLegendEntry {
     /** interactive element below the target-size floor, e.g.
      * "18×13 — below 24×24 (WCAG 2.5.8)" */
     undersized?: string;
+    /** the producer withheld facts about this record (`secret: true`) —
+     * a missing href here means "withheld", not "no destination" */
+    redacted?: boolean;
 }
 export interface SchematicResult {
     svg: string;
@@ -234,7 +244,16 @@ export declare const TARGET_SIZE_DEFAULT = 24;
  * finding via `flags`; that is the INTENDED path for DOM producers, and
  * the built-in never double-marks over it.
  */
-export declare const targetSizeFinding: (w: SchematicRecord, targetSize?: number) => string | null;
+/** flag kinds that claim to BE a target-size finding, and therefore
+ * supersede the built-in audit when the renderer honours producer flags.
+ * An explicit set, not a substring match: `includes('target')` let
+ * 'target-ok' — or any kind merely mentioning the word — silently stand
+ * the audit down (#8). Covers both producers' kinds in the wild
+ * (haltija: 'target', 'smallTarget'; tosijs auditFlags: 'target-size'). */
+export declare const TARGET_FLAG_KINDS: ReadonlySet<string>;
+export declare const targetSizeFinding: (w: SchematicRecord, targetSize?: number, { honorProducerFlags }?: {
+    honorProducerFlags?: boolean | undefined;
+}) => string | null;
 export declare const schematic: (description: SchematicDescription, options?: SchematicOptions) => SchematicResult;
 /** the string-only form — schematic().svg, kept for drop-in compatibility */
 export declare const schematicSVG: (description: SchematicDescription, options?: SchematicOptions) => string;

package/dist/index.js

@@ -30,6 +30,7 @@ var NEVER_BOUND = new Set([
 var hasTwoWayBinding = (w) => Object.entries(w).some(([key, v]) => !NEVER_BOUND.has(key) && boundTwoWay(v));
 var hasActEvidence = (w) => w.on != null || w.interactive === true || typeof w.href === "string" && w.href !== "";
 var hasEditEvidence = (w) => w.editable === true || w.contentEditable === true || hasTwoWayBinding(w);
+var hasCapabilityEvidence = (w) => w.on != null || w.interactive === true || w.editable === true || Object.entries(w).some(([key, v]) => !NEVER_BOUND.has(key) && typeof v === "string" && (v.includes(BOUND_TWO_WAY) || v.includes(BOUND_TO_DOM)));
 var boundsOf = (element) => {
   const rect = element.getBoundingClientRect();
   return {
@@ -39,21 +40,30 @@ var boundsOf = (element) => {
     height: Math.round(rect.height)
   };
 };
-var isGround = (w) => w.structural === true || w.list != null && w.on == null;
+var isGround = (w) => w.structural === true || w.list != null && !hasActEvidence(w) && !hasEditEvidence(w);
 var isInteractive = (w) => !isGround(w) && (hasActEvidence(w) || hasEditEvidence(w));
 var TARGET_SIZE_DEFAULT = 24;
-var targetSizeFinding = (w, targetSize = TARGET_SIZE_DEFAULT) => {
+var TARGET_FLAG_KINDS = new Set([
+  "target",
+  "target-size",
+  "targetsize",
+  "target_size",
+  "smalltarget"
+]);
+var targetSizeFinding = (w, targetSize = TARGET_SIZE_DEFAULT, { honorProducerFlags = false } = {}) => {
   if (targetSize <= 0 || w.bounds == null || !isInteractive(w))
     return null;
+  const { width, height } = w.bounds;
+  if (width <= 0 || height <= 0)
+    return null;
   if (w.type === "checkbox" || w.type === "radio")
     return null;
-  if (w.tag === "a" && typeof w.text === "string" && w.text !== "" && w.bounds.width > w.bounds.height) {
+  if (w.tag === "a" && typeof w.text === "string" && w.text !== "" && width > height) {
     return null;
   }
-  if (Array.isArray(w.flags) && w.flags.some((f) => f.kind.toLowerCase().includes("target"))) {
+  if (honorProducerFlags && Array.isArray(w.flags) && w.flags.some((f) => typeof f?.kind === "string" && TARGET_FLAG_KINDS.has(f.kind.toLowerCase()))) {
     return null;
   }
-  const { width, height } = w.bounds;
   return width < targetSize || height < targetSize ? `${width}×${height} — below ${targetSize}×${targetSize} (WCAG 2.5.8)` : null;
 };
 var intersects = (a, b) => a.x < b.x + b.width && b.x < a.x + a.width && a.y < b.y + b.height && b.y < a.y + a.height;
@@ -123,8 +133,8 @@ var schematic = (description, options = {}) => {
     `<svg xmlns="http://www.w3.org/2000/svg" viewBox="${minX} ${minY} ${maxX - minX} ${maxY - minY}" width="${maxX - minX}" height="${maxY - minY}">`
   ];
   const drawOrder = [...boxes].sort((a, b) => Number(isGround(b)) - Number(isGround(a)));
-  const blind = boxes.some((w) => !isGround(w)) && !description.wiring.some(isInteractive);
-  const note = blind ? "no record carries affordance evidence (on, href, contentEditable, " + "a two-way binding, or an interactive/editable assertion) — " + '"nothing here is actionable" is NOT established; a producer that ' + "cannot introspect handlers should assert `interactive`/`editable` " + "per record (see README)" : undefined;
+  const blind = boxes.some((w) => !isGround(w)) && !description.wiring.some(isInteractive) && !description.wiring.some(hasCapabilityEvidence);
+  const note = blind ? "no record carries affordance evidence (on, href, contentEditable, " + "a two-way binding, or an interactive/editable assertion), and none " + "shows the producer can see wiring at all (no handler, assertion, " + 'or provenance arrow anywhere) — "nothing here is actionable" is ' + "NOT established; a producer that cannot introspect handlers " + "should assert `interactive`/`editable` per record (see README)" : undefined;
   for (const w of drawOrder) {
     const index = description.wiring.indexOf(w);
     const pinOffsetX = w.viewportFixed === true ? minX + pad : 0;
@@ -134,9 +144,12 @@ var schematic = (description, options = {}) => {
     const { width, height } = w.bounds;
     const isContainer = w.viewportFixed !== true && boxes.some((other) => other !== w && other.viewportFixed !== true && contains(w.bounds, other.bounds));
     const toggle = w.type === "checkbox" || w.type === "radio";
+    const secret = Boolean(w.secret);
     let caption;
     let hint = false;
-    if (isContainer) {
+    if (secret) {
+      caption = `<${w.tag}> [withheld]`;
+    } else if (isContainer) {
       caption = String(w.label ?? "");
     } else if (toggle) {
       caption = String(w.label ?? "");
@@ -160,9 +173,11 @@ var schematic = (description, options = {}) => {
     const fill = structural ? "none" : w.style != null ? w.style.background : "transparent";
     const stroke = !structural && w.style != null && w.style.borderColor !== TRANSPARENT ? w.style.borderColor : "currentColor";
     const color = w.style != null ? w.style.color : "currentColor";
-    const drawImage = !structural && typeof w.image === "string" && w.image.startsWith("data:");
+    const drawImage = !structural && !secret && typeof w.image === "string" && w.image.startsWith("data:");
     const cramped = !structural && (height < minLabelHeight || width < fontSize * 3);
-    const undersized = targetSizeFinding(w, targetSize);
+    const undersized = targetSizeFinding(w, targetSize, {
+      honorProducerFlags: true
+    });
     const emphasis = structural ? ' stroke-dasharray="1 3" stroke-linecap="round" opacity="0.45"' : w.disabled === true ? ' opacity="0.4"' : actable ? ' stroke-width="2"' : "";
     parts.push(`<g data-record="${index}"${w.ref != null ? ` data-ref="${esc(String(w.ref))}"` : ""}>`);
     if (w.type === "radio") {
@@ -185,10 +200,10 @@ var schematic = (description, options = {}) => {
     }
     if (!cramped && !structural && Array.isArray(w.flags) && w.flags.length > 0) {
       w.flags.forEach((flag, at) => {
-        parts.push(`<rect x="${x + at * 3}" y="${y}" width="3" height="${height}" ` + `fill="${flagColor(flag.severity)}" data-flag="${esc(flag.kind)}"/>`);
+        parts.push(`<rect x="${x + at * 3}" y="${y}" width="3" height="${height}" ` + `fill="${flagColor(flag?.severity)}" ` + `data-flag="${esc(typeof flag?.kind === "string" ? flag.kind : "")}"/>`);
       });
       const first = w.flags[0];
-      if (first.label && height >= minLabelHeight) {
+      if (typeof first?.label === "string" && first.label !== "" && height >= minLabelHeight) {
         parts.push(`<rect x="${x + w.flags.length * 3 + 1}" y="${y + height - 9}" ` + `width="${first.label.length * 4.5 + 2}" height="8" ` + `fill="white" opacity="0.85"/>`, `<text x="${x + w.flags.length * 3 + 2}" y="${y + height - 2}" ` + `font-size="7" font-family="monospace" ` + `fill="${flagColor(first.severity)}">` + `${esc(neutralizeArrows(first.label))}</text>`);
       }
     }
@@ -228,13 +243,13 @@ var schematic = (description, options = {}) => {
     const elided = { index, tag: w.tag };
     if (w.ref != null)
       elided.ref = String(w.ref);
-    if (typeof w.href === "string" && w.href !== "" && !structural) {
+    if (typeof w.href === "string" && w.href !== "" && !structural && !secret) {
       elided.href = w.href;
     }
     if (cramped || truncated) {
       if (shownCaption !== "" && !toggle)
         elided.caption = caption;
-      const heldValue = shownValue(w.value);
+      const heldValue = secret ? undefined : shownValue(w.value);
       if (heldValue)
         elided.value = heldValue;
       if (cramped) {
@@ -253,7 +268,9 @@ var schematic = (description, options = {}) => {
       elided.disabled = true;
     if (undersized != null)
       elided.undersized = undersized;
-    const inLegend = elided.caption != null || elided.href != null || elided.value != null || elided.editable != null || elided.required != null || elided.flags != null || elided.invalid != null || elided.disabled != null || elided.undersized != null;
+    if (secret)
+      elided.redacted = true;
+    const inLegend = elided.redacted != null || elided.caption != null || elided.href != null || elided.value != null || elided.editable != null || elided.required != null || elided.flags != null || elided.invalid != null || elided.disabled != null || elided.undersized != null;
     if (inLegend)
       legend.push(elided);
     if (showIndex || w.ref != null || inLegend) {
@@ -334,6 +351,7 @@ var rasterizeSVG = (svg, options = {}) => {
 export {
   BOUND_TO_DOM,
   BOUND_TWO_WAY,
+  TARGET_FLAG_KINDS,
   TARGET_SIZE_DEFAULT,
   boundsOf,
   isInteractive,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tosijs-floorplan",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "Render an agent-surface map (plain records) as a floorplan SVG — the affordance grammar as a pure, dependency-free function. No DOM, no framework. Formerly tosijs-schematic.",
   "type": "module",
   "license": "Apache-2.0",

package/src/index.ts

@@ -79,6 +79,13 @@ export interface SchematicRecord {
   /** the producer's assertion that text goes in here — the DOM-side
    * counterpart of contentEditable/two-way bindings (issue #3) */
   editable?: boolean
+  /** the producer WITHHELD facts about this element (tosijs 1.11.0's
+   * secret regions: a magic-link token lives in the href, so neither
+   * label nor href is published). Drawn with a `[withheld]` caption when
+   * nothing else names it, and the legend says redacted — "this link has
+   * no destination" and "its destination was withheld" are different
+   * facts (issue #15) */
+  secret?: boolean
   [boundProp: string]: unknown
 }
 
@@ -175,6 +182,9 @@ export interface SchematicLegendEntry {
   /** interactive element below the target-size floor, e.g.
    * "18×13 — below 24×24 (WCAG 2.5.8)" */
   undersized?: string
+  /** the producer withheld facts about this record (`secret: true`) —
+   * a missing href here means "withheld", not "no destination" */
+  redacted?: boolean
 }
 
 export interface SchematicResult {
@@ -246,6 +256,24 @@ const hasActEvidence = (w: SchematicRecord): boolean =>
 const hasEditEvidence = (w: SchematicRecord): boolean =>
   w.editable === true || w.contentEditable === true || hasTwoWayBinding(w)
 
+// can this producer SEE wiring at all? Any handler, any assertion, any
+// provenance arrow — including a display-only ⟵ — proves it can (#10: a
+// read-only dashboard from a binding framework is not a blind map, it's a
+// sighted map of a page with nothing actionable on it)
+const hasCapabilityEvidence = (w: SchematicRecord): boolean =>
+  w.on != null ||
+  w.interactive === true ||
+  w.editable === true ||
+  // arrows count only in bindable fields — an arrow in a never-bindable
+  // identity/name field is page content (possibly forged), and must not
+  // fabricate capability any more than it fabricates a binding
+  Object.entries(w).some(
+    ([key, v]) =>
+      !NEVER_BOUND.has(key) &&
+      typeof v === 'string' &&
+      (v.includes(BOUND_TWO_WAY) || v.includes(BOUND_TO_DOM))
+  )
+
 /**
  * An element's page-coordinate bounds (the same space describe() records) —
  * the natural `within` argument for a region-scoped schematic.
@@ -261,9 +289,14 @@ export const boundsOf = (element: Element): SchematicBounds => {
 }
 
 // structure behind affordances — a LIST CONTAINER is ground too: it's
-// wired (the collection binds here), but its items are the affordances
+// wired (the collection binds here), but its items are the affordances.
+// EVIDENCE BEATS CONTAINER ROLE (#7): an element that is both container
+// and control (a list-bound <select> carrying its own two-way value, a
+// list div with handlers) is an affordance wearing a list, not ground —
+// classifying it structural silenced error-severity audit findings.
 const isGround = (w: SchematicRecord): boolean =>
-  w.structural === true || (w.list != null && w.on == null)
+  w.structural === true ||
+  (w.list != null && !hasActEvidence(w) && !hasEditEvidence(w))
 
 /**
  * "Can I act here?" — the single implementation of the interactivity
@@ -298,27 +331,52 @@ export const TARGET_SIZE_DEFAULT = 24
  * finding via `flags`; that is the INTENDED path for DOM producers, and
  * the built-in never double-marks over it.
  */
+/** flag kinds that claim to BE a target-size finding, and therefore
+ * supersede the built-in audit when the renderer honours producer flags.
+ * An explicit set, not a substring match: `includes('target')` let
+ * 'target-ok' — or any kind merely mentioning the word — silently stand
+ * the audit down (#8). Covers both producers' kinds in the wild
+ * (haltija: 'target', 'smallTarget'; tosijs auditFlags: 'target-size'). */
+export const TARGET_FLAG_KINDS: ReadonlySet<string> = new Set([
+  'target',
+  'target-size',
+  'targetsize',
+  'target_size',
+  'smalltarget',
+])
+
 export const targetSizeFinding = (
   w: SchematicRecord,
-  targetSize = TARGET_SIZE_DEFAULT
+  targetSize = TARGET_SIZE_DEFAULT,
+  { honorProducerFlags = false } = {}
 ): string | null => {
   if (targetSize <= 0 || w.bounds == null || !isInteractive(w)) return null
+  const { width, height } = w.bounds
+  // hidden is not small (#9): a 0×0 (or unlaid-out) element is not a
+  // target too small to hit — the guard lives here so callers passing raw
+  // wiring don't each grow their own copy
+  if (width <= 0 || height <= 0) return null
   if (w.type === 'checkbox' || w.type === 'radio') return null
   if (
     w.tag === 'a' &&
     typeof w.text === 'string' &&
     w.text !== '' &&
-    w.bounds.width > w.bounds.height
+    width > height
   ) {
     return null
   }
+  // supersession is a DRAWING concern — no double bars for one finding —
+  // so it is opt-in (#8): schematic() passes true; an audit consuming this
+  // rule wants the geometry verdict regardless of what the producer drew
   if (
+    honorProducerFlags &&
     Array.isArray(w.flags) &&
-    w.flags.some((f) => f.kind.toLowerCase().includes('target'))
+    w.flags.some(
+      (f) => typeof f?.kind === 'string' && TARGET_FLAG_KINDS.has(f.kind.toLowerCase())
+    )
   ) {
     return null
   }
-  const { width, height } = w.bounds
   return width < targetSize || height < targetSize
     ? `${width}×${height} — below ${targetSize}×${targetSize} (WCAG 2.5.8)`
     : null
@@ -475,15 +533,21 @@ export const schematic = (
   // result says so instead of letting silence claim the first.
   // evidence is judged over the WHOLE wiring, not the drawn subset: a
   // `within` crop of a map whose evidence lies outside the region is not a
-  // blind map, it's a blind REGION of a sighted one (review follow-up)
+  // blind map, it's a blind REGION of a sighted one (review follow-up).
+  // And CAPABILITY evidence counts (#10): a producer that emits handlers
+  // or provenance arrows anywhere demonstrably can see wiring — absence of
+  // affordance is then a fact about the page, not the producer's eyes.
   const blind =
-    boxes.some((w) => !isGround(w)) && !description.wiring.some(isInteractive)
+    boxes.some((w) => !isGround(w)) &&
+    !description.wiring.some(isInteractive) &&
+    !description.wiring.some(hasCapabilityEvidence)
   const note = blind
     ? 'no record carries affordance evidence (on, href, contentEditable, ' +
-      'a two-way binding, or an interactive/editable assertion) — ' +
-      '"nothing here is actionable" is NOT established; a producer that ' +
-      'cannot introspect handlers should assert `interactive`/`editable` ' +
-      'per record (see README)'
+      'a two-way binding, or an interactive/editable assertion), and none ' +
+      'shows the producer can see wiring at all (no handler, assertion, ' +
+      'or provenance arrow anywhere) — "nothing here is actionable" is ' +
+      'NOT established; a producer that cannot introspect handlers ' +
+      'should assert `interactive`/`editable` per record (see README)'
     : undefined
   for (const w of drawOrder) {
     const index = description.wiring.indexOf(w)
@@ -512,9 +576,24 @@ export const schematic = (
     //   back to its placeholder in italics (a hint must not read as content)
     // - everything else: label, then text, then value
     const toggle = w.type === 'checkbox' || w.type === 'radio'
+    // fail-closed means malformed errs toward WITHHOLDING (review F1): a
+    // truthy non-boolean secret (secret: 1 from mangled producer JSON)
+    // must scrub, not leak — every redaction gate shares this coercion
+    const secret = Boolean(w.secret)
     let caption: string
     let hint = false
-    if (isContainer) {
+    if (secret) {
+      // FAIL-CLOSED redaction (0.5.0 review G1 + round-2 B1): a secret
+      // record's withholdable facts — label, text, value, placeholder,
+      // href, and image (the captured pixels are the highest-bandwidth
+      // fact of all) — never reach the drawing, even when a producer bug
+      // left them in
+      // the record. `redacted` must never co-occur with the facts it
+      // claims were withheld; the marker is all a secret record says.
+      // (Assigned BEFORE the choke point so a forged arrow in `tag`
+      // still neutralizes — review R1.)
+      caption = `<${w.tag}> [withheld]`
+    } else if (isContainer) {
       caption = String(w.label ?? '')
     } else if (toggle) {
       caption = String(w.label ?? '')
@@ -572,7 +651,10 @@ export const schematic = (
     // embedded media first: pixels the producer captured, drawn in place —
     // everything else (state geometry, captions, badges) reads over it
     const drawImage =
-      !structural && typeof w.image === 'string' && w.image.startsWith('data:')
+      !structural &&
+      !secret && // B1: withheld pixels never draw
+      typeof w.image === 'string' &&
+      w.image.startsWith('data:')
     // CRAMPED: the box can't legibly carry its dress — draw it bare (shape,
     // state geometry, emphasis, focus) with an auto stamp pointing into the
     // legend, where the metadata actually lives. Toggles are exempt from
@@ -585,7 +667,9 @@ export const schematic = (
     // the toggle and inline-link exemptions, producer-flag supersession —
     // lives in the exported targetSizeFinding (issue #4: one
     // implementation, shared with tosijs's audit).
-    const undersized = targetSizeFinding(w, targetSize)
+    const undersized = targetSizeFinding(w, targetSize, {
+      honorProducerFlags: true,
+    })
     const emphasis = structural
       ? ' stroke-dasharray="1 3" stroke-linecap="round" opacity="0.45"'
       : w.disabled === true
@@ -642,13 +726,17 @@ export const schematic = (
     // the LEFT edge — the unclaimed slot — plus the first flag's label
     if (!cramped && !structural && Array.isArray(w.flags) && w.flags.length > 0) {
       w.flags.forEach((flag, at) => {
+        // kind is producer JSON too (#12) — same defence severity gets
         parts.push(
           `<rect x="${x + at * 3}" y="${y}" width="3" height="${height}" ` +
-            `fill="${flagColor(flag.severity)}" data-flag="${esc(flag.kind)}"/>`
+            `fill="${flagColor(flag?.severity)}" ` +
+            `data-flag="${esc(typeof flag?.kind === 'string' ? flag.kind : '')}"/>`
         )
       })
       const first = w.flags[0]
-      if (first.label && height >= minLabelHeight) {
+      // producer JSON to the last line (R2): flags:[null] and non-string
+      // labels must not take down the render — same defence the forEach got
+      if (typeof first?.label === 'string' && first.label !== '' && height >= minLabelHeight) {
         parts.push(
           `<rect x="${x + w.flags.length * 3 + 1}" y="${y + height - 9}" ` +
             `width="${first.label.length * 4.5 + 2}" height="8" ` +
@@ -764,12 +852,17 @@ export const schematic = (
     // a destination is always legend-worthy: it never fits a caption
     // legibly, and it's the fact an agent acts on ("goes to Y", not
     // "says X")
-    if (typeof w.href === 'string' && w.href !== '' && !structural) {
+    if (
+      typeof w.href === 'string' &&
+      w.href !== '' &&
+      !structural &&
+      !secret // G1: a withheld destination never reaches the legend
+    ) {
       elided.href = w.href
     }
     if (cramped || truncated) {
       if (shownCaption !== '' && !toggle) elided.caption = caption
-      const heldValue = shownValue(w.value)
+      const heldValue = secret ? undefined : shownValue(w.value)
       if (heldValue) elided.value = heldValue
       if (cramped) {
         if (editable) elided.editable = true
@@ -782,7 +875,12 @@ export const schematic = (
     if (w.invalid === true && cramped) elided.invalid = true
     if (w.disabled === true && cramped) elided.disabled = true
     if (undersized != null) elided.undersized = undersized
+    // redaction ALWAYS rides the legend, structural included: redacted is
+    // a fact about the record, not a drawing concern — the consumer
+    // reading "no href" must be able to tell withheld from absent (#15)
+    if (secret) elided.redacted = true
     const inLegend =
+      elided.redacted != null ||
       elided.caption != null ||
       elided.href != null ||
       elided.value != null ||

package/src/schematic.test.ts

@@ -556,6 +556,164 @@ describe('decorate — the plugin seam', () => {
   })
 })
 
+describe('the 1.11.0 adoption feedback (0.5.0 — #7/#8/#9/#10/#12/#15)', () => {
+  const at = (x: number, y: number, width = 160, height = 24) => ({ x, y, width, height })
+
+  test('evidence beats container role: a list-bound <select> that IS the control is an affordance (#7)', () => {
+    const select = {
+      tag: 'select',
+      list: { path: 'app.options', idPath: 'id' },
+      value: 'b ⟷ app.choice',
+      bounds: { x: 10, y: 10, width: 20, height: 20 },
+    }
+    expect(isInteractive(select)).toBe(true)
+    expect(targetSizeFinding(select)).toBe('20×20 — below 24×24 (WCAG 2.5.8)')
+    const { svg } = schematic({ wiring: [select] })
+    expect(svg).not.toContain('stroke-dasharray') // control, not ground
+    // …while a plain list container without evidence of its own stays ground
+    expect(isInteractive({ tag: 'ul', list: { path: 'a.items' } })).toBe(false)
+  })
+
+  test('supersession cannot be bought with a kind that merely mentions target (#8)', () => {
+    const tiny = { tag: 'button', on: { click: 'ƒ' }, bounds: { x: 0, y: 0, width: 10, height: 10 } }
+    const finding = '10×10 — below 24×24 (WCAG 2.5.8)'
+    // claims to BE a target-size finding: supersedes (when honoured)
+    for (const kind of ['target', 'target-size', 'smallTarget', 'TARGET_SIZE']) {
+      expect(targetSizeFinding({ ...tiny, flags: [{ kind, label: 'x' }] }, 24, { honorProducerFlags: true })).toBeNull()
+    }
+    // merely mentions the word: does not
+    for (const kind of ['target-ok', 'TARGETS ARE FINE', 'retargeting']) {
+      expect(targetSizeFinding({ ...tiny, flags: [{ kind, label: 'x' }] }, 24, { honorProducerFlags: true })).toBe(finding)
+    }
+  })
+
+  test('hidden is not small: zero-size records are not undersized (#9)', () => {
+    expect(targetSizeFinding({ tag: 'button', on: { click: 'ƒ' }, bounds: { x: 0, y: 0, width: 0, height: 0 } })).toBeNull()
+  })
+
+  test('capability evidence suppresses the blind-map note: a read-only dashboard is not a blind map (#10)', () => {
+    const dashboard = schematic({
+      wiring: [
+        { tag: 'span', text: '21°C ⟵ dash.temp', bounds: at(10, 10) },
+        { tag: 'span', text: '40% ⟵ dash.humidity', bounds: at(10, 40) },
+      ],
+    })
+    // display bindings prove the producer can see wiring — nothing here is
+    // actionable, and that IS established
+    expect(dashboard.note).toBeUndefined()
+  })
+
+  test('a flags entry without kind neither throws nor colors outside the lines (#12)', () => {
+    const record = {
+      tag: 'button',
+      on: { click: 'ƒ' },
+      label: 'Go',
+      flags: [{ label: 'x' }] as any,
+      bounds: { x: 0, y: 0, width: 10, height: 10 },
+    }
+    expect(targetSizeFinding(record, 24, { honorProducerFlags: true })).toBe('10×10 — below 24×24 (WCAG 2.5.8)')
+    const { svg } = schematic({ wiring: [{ ...record, bounds: at(10, 10) }] })
+    expect(svg).toContain('data-flag=""')
+  })
+
+  test('redaction is FAIL-CLOSED: facts a producer bug left in a secret record never reach drawing or legend (review G1)', () => {
+    const { svg, legend } = schematic({
+      wiring: [
+        {
+          tag: 'a',
+          secret: true,
+          // the failure this guards: marked secret, but the withholding
+          // upstream didn't happen — the renderer must not republish
+          href: 'https://app.example/magic?token=SECRET123',
+          label: 'reset for ada@example.com',
+          text: 'leaky text',
+          value: 'SECRET123',
+          on: { click: 'ƒ' },
+          bounds: at(10, 10),
+        },
+      ],
+    })
+    const everything = svg + JSON.stringify(legend)
+    expect(everything).not.toContain('SECRET123')
+    expect(everything).not.toContain('ada@example.com')
+    expect(everything).not.toContain('leaky text')
+    expect(svg).toContain('&lt;a&gt; [withheld]')
+    expect(legend[0].redacted).toBe(true)
+    expect(legend[0].href).toBeUndefined()
+    expect(legend[0].value).toBeUndefined()
+  })
+
+  test('withheld PIXELS never draw: image joins the fail-closed list (round-2 B1)', () => {
+    const px = 'data:image/gif;base64,SECRETPIXELS0000000000000000000000000000000='
+    const { svg, legend } = schematic({
+      wiring: [{ tag: 'canvas', secret: true, image: px, label: 'private chart', text: 'leaky text', bounds: at(10, 10, 200, 100) }],
+    })
+    const everything = svg + JSON.stringify(legend)
+    expect(everything).not.toContain('SECRETPIXELS')
+    expect(everything).not.toContain('private chart')
+    expect(everything).not.toContain('leaky text')
+    expect(svg).not.toContain('<image')
+    expect(svg).toContain('[withheld]')
+  })
+
+  test('fail-closed means malformed errs toward withholding: a truthy non-boolean secret scrubs (round-2 F1)', () => {
+    const { svg, legend } = schematic({
+      wiring: [{ tag: 'a', secret: 1 as any, href: '/magic?token=SECRET123', label: 'leaky', on: { click: 'ƒ' }, bounds: at(10, 10) }],
+    })
+    const everything = svg + JSON.stringify(legend)
+    expect(everything).not.toContain('SECRET123')
+    expect(everything).not.toContain('leaky')
+    expect(legend[0].redacted).toBe(true)
+  })
+
+  test('the [withheld] caption sits under the choke point: a forged arrow in tag neutralizes (review R1)', () => {
+    const { svg } = schematic({
+      wiring: [{ tag: 'a ⟷ fake', secret: true, bounds: at(10, 10) }],
+    })
+    expect(svg).not.toContain('⟷')
+    expect(svg).toContain('[withheld]')
+  })
+
+  test('structural redaction is still a legend fact — redacted is about the record, not the drawing', () => {
+    const { legend } = schematic({
+      wiring: [{ tag: 'section', structural: true, secret: true, bounds: at(10, 10, 300, 100) }],
+    })
+    expect(legend[0]?.redacted).toBe(true)
+  })
+
+  test('flags:[null] and non-string labels do not take down the render (review R2)', () => {
+    const { svg } = schematic({
+      wiring: [
+        { tag: 'button', on: { click: 'ƒ' }, flags: [null] as any, bounds: at(10, 10) },
+        { tag: 'button', on: { click: 'ƒ' }, flags: [{ kind: 'x', label: 42 }] as any, bounds: at(10, 40) },
+      ],
+    })
+    expect(svg).toContain('data-record="1"') // both drew; nothing threw
+  })
+
+  test('a mid-content display arrow is capability evidence too — any position, by the format\'s own parse (#10 doc pin)', () => {
+    const { note } = schematic({
+      wiring: [{ tag: 'span', text: 'total: 3 ⟵ app.total today', bounds: at(10, 10) }],
+    })
+    expect(note).toBeUndefined()
+  })
+
+  test('a redacted record draws its withholding, and the legend says so (#15)', () => {
+    const { svg, legend } = schematic({
+      wiring: [
+        // tosijs 1.11.0's secret-region shape: neither label nor href
+        { tag: 'a', secret: true, text: '⟵ s.name', on: { click: 'ƒ' }, bounds: at(10, 10) },
+        { tag: 'a', text: 'plain link', href: '/x', on: { click: 'ƒ' }, bounds: at(10, 40) },
+      ],
+    })
+    expect(svg).toContain('&lt;a&gt; [withheld]') // not an anonymous bare box
+    const entry = legend.find((e) => e.redacted)!
+    expect(entry.index).toBe(0)
+    expect(entry.href).toBeUndefined() // withheld, and the legend SAYS withheld
+    expect(legend.find((e) => e.index === 1)!.redacted).toBeUndefined()
+  })
+})
+
 describe('producer compatibility — interface-typed maps assign without casts', () => {
   test("a describe()-shaped interface flows straight in", () => {
     // mirrors tosijs's AgentDescription: an INTERFACE (no implicit index
@@ -949,7 +1107,10 @@ describe('producer-asserted affordance and defensive parsing (0.4.0 — #2/#3/#4
     expect(targetSizeFinding(icon)).toBe('16×16 — below 24×24 (WCAG 2.5.8)')
     expect(targetSizeFinding(icon, 0)).toBeNull() // 0 disables
     expect(targetSizeFinding({ ...icon, text: 'terms', bounds: { x: 0, y: 0, width: 34, height: 16 } })).toBeNull() // text-sized
-    expect(targetSizeFinding({ ...icon, flags: [{ kind: 'target', label: '16x16' }] })).toBeNull() // producer supersedes
+    // supersession is opt-in as of 0.5.0 (#8): the bare rule reports
+    // geometry truth; only the renderer (no double bars) passes true
+    expect(targetSizeFinding({ ...icon, flags: [{ kind: 'target', label: '16x16' }] })).toBe('16×16 — below 24×24 (WCAG 2.5.8)')
+    expect(targetSizeFinding({ ...icon, flags: [{ kind: 'target', label: '16x16' }] }, 24, { honorProducerFlags: true })).toBeNull()
     expect(targetSizeFinding({ tag: 'input', type: 'checkbox', value: 'x ⟷ a.on', bounds: { x: 0, y: 0, width: 13, height: 13 } })).toBeNull() // toggles exempt
   })
 })