unoverse 0.1.171 → 0.1.173

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unoverse",
-  "version": "0.1.171",
+  "version": "0.1.173",
   "description": "The Unoverse front door — create a Studio project, a universe, or a client app, and launch Studio.",
   "license": "SEE LICENSE IN README.md",
   "type": "module",

package/vendor/base/lint/design/defs.mjs

@@ -1,5 +1,5 @@
 /**
- * Definition file formats: how an rx definition is named, found and parsed.
+ * Definition file formats: how a design definition is named, found and parsed.
  *
  * Mirrors the server's fsCache.ts, deliberately. A definition is `.yaml` or `.json`, and
  * the linter must agree with the loader about which file IS the definition, or it lints a

package/vendor/base/lint/design/file.mjs

@@ -28,7 +28,7 @@ function checkStateOrder(order, rootFolder, file, includeLayouts = false) {
       ? readdirSync(d).filter(isDefFile).map(defName)
       : [];
   };
-  // TEMPLATES: stateOrder lists LOCAL states + LAYOUTS in picker order (docs/design/05) —
+  // TEMPLATES: stateOrder lists LOCAL states + LAYOUTS in picker order (docs.unoverse.ai/design/apps) —
   // a layout name (the view a component enters) is a valid entry. COMPONENTS: states only.
   const stateNames = dirNames("states");
   const onDisk = new Set([...stateNames, ...(includeLayouts ? dirNames("layouts") : [])]);
@@ -39,7 +39,7 @@ function checkStateOrder(order, rootFolder, file, includeLayouts = false) {
   // legitimately omitted, so never warn on layouts.
   for (const name of stateNames)
     if (!order.includes(name))
-      report("warn", file, `states/${name}.json is not in stateOrder. It falls to the end of the picker; add it to lock the order (docs/design/07)`);
+      report("warn", file, `states/${name}.json is not in stateOrder. It falls to the end of the picker; add it to lock the order (docs.unoverse.ai/design/studio)`);
 }
 
 // ── lint one file ──
@@ -49,7 +49,7 @@ function lintFile(file) {
   const src = readText(file);
 
   // LAW 1 — tokens only (skip manifest + fixture; styles/ is never in a def home).
-  // Exempt: `appWidth` — the HOST-facing outer width (state-owned sizing, docs/design/05).
+  // Exempt: `appWidth` — the HOST-facing outer width (state-owned sizing, docs.unoverse.ai/design/apps).
   // It is raw CSS the embed host applies to the app panel ("min(50vw, 760px)", "360px"),
   // never a style the SDK resolves — token law governs the inside, not the envelope.
   if (!isFixture(file) && !isHook(file) && !isManifest(file))
@@ -74,7 +74,7 @@ function lintFile(file) {
         }
       }
       if (RAW_VALUE.test(code) && !/^\s*"?appWidth"?\s*:/.test(code))
-        report("error", file, `raw value. Token names only; add/scale a token in the org styles instead (LAW 1, docs/design/06): ${code.trim()}`, i + 1);
+        report("error", file, `raw value. Token names only; add/scale a token in the org styles instead (LAW 1, docs.unoverse.ai/design/styles-and-tokens): ${code.trim()}`, i + 1);
     });
 
   let json;
@@ -93,9 +93,9 @@ function lintFile(file) {
     if (isAppPath(file)) {
       // TEMPLATE manifest = the envelope. Requires binding + a resolvable root.
       for (const req of ["name", "whenToUse"])
-        if (!json[req]) report("warn", file, `template manifest missing "${req}": ${req === "whenToUse" ? "the AI selects the app by it" : "the display name"} (docs/design/05)`);
+        if (!json[req]) report("warn", file, `template manifest missing "${req}": ${req === "whenToUse" ? "the AI selects the app by it" : "the display name"} (docs.unoverse.ai/design/apps)`);
       if (!(json.binding && json.binding.workflow))
-        report("warn", file, `template manifest has no binding.workflow. The app owns its workflow binding (docs/design/05)`);
+        report("warn", file, `template manifest has no binding.workflow. The app owns its workflow binding (docs.unoverse.ai/design/apps)`);
       // Two valid roots (definitions.ts:229): the STANDARD manifest-only form (root =
       // layouts/<layout>), OR a `<name>` envelope OVERRIDE (its own root). Only the
       // manifest-only form must resolve a layout; an envelope-form template supplies its own.
@@ -103,7 +103,7 @@ function lintFile(file) {
       if (!hasEnvelope) {
         const layoutName = json.layout ?? "main";
         if (!defPath(join(root, "layouts"), layoutName))
-          report("error", file, `manifest.layout "${layoutName}" → layouts/${layoutName} does not exist (and no <name> envelope) (docs/design/05)`);
+          report("error", file, `manifest.layout "${layoutName}" → layouts/${layoutName} does not exist (and no <name> envelope) (docs.unoverse.ai/design/apps)`);
       }
       // THE TEMPLATE TREE (STATE_MODEL v2, checkpoint 2026-08-08): a manifest
       // `states:` block declares the whole machine — validate the DECLARATION:
@@ -171,7 +171,7 @@ function lintFile(file) {
             report("warn", file, `"stateOrder" is superseded by the "states" tree (the ladder derives from the top level minus the base) — delete it (STATE_MODEL §5)`);
         }
       } else checkStateOrder(json.stateOrder, root, file, /* includeLayouts */ true);
-      // ONE STATE AT A TIME (docs/design/04): the active state is derived from the
+      // ONE STATE AT A TIME (docs.unoverse.ai/design/state): the active state is derived from the
       // latest surfaced VIEW, so no two surfaces in one template may claim the same
       // view — the active surface would be ambiguous.
       {
@@ -182,7 +182,7 @@ function lintFile(file) {
           const w = n.type === "ComponentSlot" ? n.select?.where : null;
           if ((w?.field === "view" || w?.field === "defaultState") && typeof w.eq === "string") {
             if (claims.has(w.eq))
-              report("error", file, `two reaction surfaces claim the view "${w.eq}" (${claims.get(w.eq)} and ${from}). A template is in ONE state at a time; each view has exactly one surface (docs/design/04)`);
+              report("error", file, `two reaction surfaces claim the view "${w.eq}" (${claims.get(w.eq)} and ${from}). A template is in ONE state at a time; each view has exactly one surface (docs.unoverse.ai/design/state)`);
             else claims.set(w.eq, from);
           }
           for (const v of Object.values(n)) if (v && typeof v === "object") collectClaims(v, from);
@@ -200,16 +200,16 @@ function lintFile(file) {
         }
       }
       if (json.mode !== undefined && json.defaultState === undefined)
-        report("warn", file, `"mode" was renamed to "defaultState". Still read as a fallback, but rename it (docs/design/04)`);
+        report("warn", file, `"mode" was renamed to "defaultState". Still read as a fallback, but rename it (docs.unoverse.ai/design/state)`);
       // `preview` — the per-state MOCK map ({ "<state>": ["course-card", …] }): each key
       // must be a states/ file, each name a real component. A repeated name seeds
       // several instances (a card rail).
       if (json.preview !== undefined) {
         if (!json.preview || typeof json.preview !== "object" || Array.isArray(json.preview))
-          report("error", file, `"preview" must be an object mapping state names to component-name arrays (docs/design/07)`);
+          report("error", file, `"preview" must be an object mapping state names to component-name arrays (docs.unoverse.ai/design/studio)`);
         else {
           // preview keys are per-LAYOUT (the component view Studio mocks) or a local state
-          // (docs/design/05) — resolve against states/ ∪ layouts/, same as stateOrder.
+          // (docs.unoverse.ai/design/apps) — resolve against states/ ∪ layouts/, same as stateOrder.
           const viewsIn = (sub) => {
             const d = join(root, sub);
             return existsSync(d)
@@ -228,7 +228,7 @@ function lintFile(file) {
           const comps = componentNamesForFile(file);
           for (const [state, list] of Object.entries(json.preview)) {
             if (!states.has(state))
-              report("error", file, `preview."${state}". No states/${state}.json or layouts/${state}.json in this template (docs/design/07)`);
+              report("error", file, `preview."${state}". No states/${state}.json or layouts/${state}.json in this template (docs.unoverse.ai/design/studio)`);
             // An OBJECT entry is authored TEMPLATE-STATE mock data (what the workflow
             // would have echoed — comments, a discriminant, an anchor), merged verbatim
             // when the state's pill is picked. Only the two shapes; anything else errors.
@@ -239,37 +239,37 @@ function lintFile(file) {
             }
             for (const c of list)
               if (comps && !comps.has(String(c).toLowerCase()))
-                report("error", file, `preview."${state}" names unknown component "${c}". No match in rx/components/ or this org's components/ (org-privacy: another org's components are out of reach; lookup is case-insensitive)`);
+                report("error", file, `preview."${state}" names unknown component "${c}". No match in design/marketplace/components/ or this org's components/ (org-privacy: another org's components are out of reach; lookup is case-insensitive)`);
           }
         }
       }
-      // Sizing is STATE-OWNED (docs/design/05): the layout root's `appWidth` is the core
+      // Sizing is STATE-OWNED (docs.unoverse.ai/design/apps): the layout root's `appWidth` is the core
       // surface's constant width; a panel slot's `appWidth` slides out on top. Manifest
       // width/focusWidth are DEAD — nothing reads them; there is no fallback.
       for (const dep of ["width", "focusWidth"])
         if (json[dep] !== undefined)
-          report("error", file, `manifest "${dep}" is dead. Nothing reads it. Sizing is state-owned: \`appWidth\` on the layout root (constant core width) or on a panel (slide-out width) (docs/design/05)`);
+          report("error", file, `manifest "${dep}" is dead. Nothing reads it. Sizing is state-owned: \`appWidth\` on the layout root (constant core width) or on a panel (slide-out width) (docs.unoverse.ai/design/apps)`);
     } else {
       // COMPONENT manifest = OPTIONAL spatial discovery. No binding. Mirrors the
       // discovery-meta assertions in server/src/runtime/microapp-structure.test.ts.
       const desc = typeof json.description === "string" ? json.description.trim() : "";
       if (desc.length < 20)
-        report("error", file, `discovery manifest.description missing/too short. One line (≥20 chars) saying what the component IS (docs/design/03a)`);
+        report("error", file, `discovery manifest.description missing/too short. One line (≥20 chars) saying what the component IS (docs.unoverse.ai/design/components)`);
       else if (desc.length > 120)
-        report("error", file, `discovery manifest.description is ${desc.length} chars: it's the listing subtitle (≤120); move detail into whenToUse (docs/design/03a)`);
+        report("error", file, `discovery manifest.description is ${desc.length} chars: it's the listing subtitle (≤120); move detail into whenToUse (docs.unoverse.ai/design/components)`);
       const wtu = typeof json.whenToUse === "string" ? json.whenToUse.trim() : "";
       if (wtu.length < 20)
-        report("error", file, `discovery manifest.whenToUse missing/too short. The utterance-shaped selection text findIntent ranks on (docs/design/03a)`);
+        report("error", file, `discovery manifest.whenToUse missing/too short. The utterance-shaped selection text findIntent ranks on (docs.unoverse.ai/design/components)`);
       else if (/\b(pick when|use (this|when)|when the user|the user (asks|wants|needs)|select (this|when))\b/i.test(wtu))
-        report("error", file, `discovery manifest.whenToUse is selector-shaped. Write the words the USER would say, not instructions about the user (docs/design/03a)`);
+        report("error", file, `discovery manifest.whenToUse is selector-shaped. Write the words the USER would say, not instructions about the user (docs.unoverse.ai/design/components)`);
       if (json.binding)
-        report("warn", file, `a component discovery manifest has no workflow. Drop "binding" (a component is streamed or node-hydrated) (docs/design/03a)`);
-      // `lifetime` — OPTIONAL render lifetime (docs/design/04 §Two lifetimes). Closed set:
+        report("warn", file, `a component discovery manifest has no workflow. Drop "binding" (a component is streamed or node-hydrated) (docs.unoverse.ai/design/components)`);
+      // `lifetime` — OPTIONAL render lifetime (docs.unoverse.ai/design/state §Two lifetimes). Closed set:
       // "turn" (default — the universal new-turn reset) | "conversation" (durable
       // conversation-scoped surface: conversation-keyed instance, exempt from the
       // new-turn reset, retired only by replacement, self-close, or a template swap).
       if (json.lifetime !== undefined && json.lifetime !== "turn" && json.lifetime !== "conversation")
-        report("error", file, `manifest "lifetime" must be "turn" (default) or "conversation". Got ${JSON.stringify(json.lifetime)} (docs/design/04 §Two lifetimes)`);
+        report("error", file, `manifest "lifetime" must be "turn" (default) or "conversation". Got ${JSON.stringify(json.lifetime)} (docs.unoverse.ai/design/state §Two lifetimes)`);
     }
     return;
   }
@@ -280,11 +280,11 @@ function lintFile(file) {
   if (isEnvelope) {
     // COMPONENT envelope (templates have no envelope — their manifest is it).
     for (const req of ["kind", "name", "root"])
-      if (json[req] === undefined) report("error", file, `envelope missing "${req}" (docs/design/02)`);
+      if (json[req] === undefined) report("error", file, `envelope missing "${req}" (docs.unoverse.ai/design/sdui-and-mcp-apps)`);
     if (json.kind && !["component", "template", "atom"].includes(json.kind))
       report("error", file, `unknown kind "${json.kind}"`);
     if (json.kind === "component" && !json.category)
-      report("warn", file, `component has no "category". Used to group it in the palette (docs/design/02)`);
+      report("warn", file, `component has no "category". Used to group it in the palette (docs.unoverse.ai/design/sdui-and-mcp-apps)`);
     if (json.root) walkNode(json.root, file, root);
 
     // ── the contained-microapp discipline (mirrors microapp-structure.test.ts) ──
@@ -300,7 +300,7 @@ function lintFile(file) {
       if (defPath(root, "manifest"))
         for (const k of ["description", "whenToUse"])
           if (json[k] !== undefined)
-            report("error", file, `envelope duplicates manifest meta "${k}". The discovery manifest is the single home (docs/design/03a)`);
+            report("error", file, `envelope duplicates manifest meta "${k}". The discovery manifest is the single home (docs.unoverse.ai/design/components)`);
 
       // deprecated bridge: a top-level `defaultState` triggers the component node APP_DATA emit
       if (json.defaultState !== undefined)
@@ -317,7 +317,7 @@ function lintFile(file) {
           .filter(([, v]) => !(v && typeof v === "object" && typeof v.input === "boolean"))
           .map(([k]) => k);
         if (undeclared.length)
-          report("error", file, `microapp props [${undeclared.join(", ")}] do not declare "input". Every prop says what fills it: input:true = a workflow streams it (it joins the node's configSchema); input:false = nothing does (a preview axis, or a literal the host passes via Ref with). Unflagged props default to INPUTS (docs/design/03)`);
+          report("error", file, `microapp props [${undeclared.join(", ")}] do not declare "input". Every prop says what fills it: input:true = a workflow streams it (it joins the node's configSchema); input:false = nothing does (a preview axis, or a literal the host passes via Ref with). Unflagged props default to INPUTS (docs.unoverse.ai/design/components)`);
 
         // STATE MODEL v2 (UNOVERSE_STATE_MODEL §5): an authored `state.view` TREE is
         // the component's state machine — the ONE object the scalar rule admits.
@@ -344,9 +344,9 @@ function lintFile(file) {
           for (const [k, v] of Object.entries(json.state)) {
             if (k === "view" && viewTree) continue;
             if (Array.isArray(v) || (v && typeof v === "object"))
-              report("error", file, `state.${k} is an ${Array.isArray(v) ? "array" : "object"}. The state block is SCALAR view-state only (the one object allowed is a well-formed v2 \`state.view\` tree); workflow-fed data → props (input:true), static content → hardcode in the layout (docs/design/03)`);
+              report("error", file, `state.${k} is an ${Array.isArray(v) ? "array" : "object"}. The state block is SCALAR view-state only (the one object allowed is a well-formed v2 \`state.view\` tree); workflow-fed data → props (input:true), static content → hardcode in the layout (docs.unoverse.ai/design/components)`);
             else if (typeof v === "string" && /^https?:\/\//.test(v))
-              report("error", file, `state.${k} is a URL. Content, not view-state; hardcode it in the layout (or props input:true if workflow-fed) (docs/design/03)`);
+              report("error", file, `state.${k} is a URL. Content, not view-state; hardcode it in the layout (or props input:true if workflow-fed) (docs.unoverse.ai/design/components)`);
           }
 
         if (hasLayouts) {
@@ -356,7 +356,7 @@ function lintFile(file) {
             if (!raw.includes('"on":"view"') || !/"\$include":"layouts\//.test(raw))
               report("error", file, `a v2 component (state.view tree) must root-Switch on "view" → $include layouts/<layout> (each state owns its layout; same-name by convention) (STATE_MODEL §5)`);
           } else if (!raw.includes('"on":"defaultState"') || !/"\$include":"layouts\//.test(raw))
-            report("error", file, `a faced component's root must Switch on defaultState → $include layouts/<state> (legacy; or declare a v2 state.view tree and Switch on "view") (docs/design/03)`);
+            report("error", file, `a faced component's root must Switch on defaultState → $include layouts/<state> (legacy; or declare a v2 state.view tree and Switch on "view") (docs.unoverse.ai/design/components)`);
 
           // ── face set ⇄ layouts/ cross-check (OPEN name set — inline/focused/<any>) ──
           // The FACES are the root Switch's cases; Studio's face toggle and the render
@@ -375,7 +375,7 @@ function lintFile(file) {
             const caseNames = Object.keys(cases).filter((k) => k !== "default");
             // inline is the UNIVERSAL default face: an unknown/absent defaultState must
             // render SOMETHING — require an `inline` case or an explicit `default`.
-            // EXCEPTION — a SURFACE-ONLY component (docs/design/03): its manifest
+            // EXCEPTION — a SURFACE-ONLY component (docs.unoverse.ai/design/components): its manifest
             // declares a SURFACED arrival (defaultState naming one of its cases, not
             // inline), and it deliberately renders NOTHING while unsurfaced (e.g. a
             // rail card retired by a new turn). Then omitting inline/default is the
@@ -409,7 +409,7 @@ function lintFile(file) {
               if (name !== "default" && layoutName !== expected)
                 report("error", file, viewTree
                   ? `state "${name}" declares layout "${expected}" but its case includes layouts/${layoutName} — the tree's declaration and the case must agree (STATE_MODEL §5 rule 1)`
-                  : `face case "${name}" includes layouts/${layoutName}. The layout FILENAME is the state name; rename one so they match (docs/design/03)`);
+                  : `face case "${name}" includes layouts/${layoutName}. The layout FILENAME is the state name; rename one so they match (docs.unoverse.ai/design/components)`);
             }
             // v2: tree-declared layouts (including nested substates' and variants') are
             // reachable by declaration — seed them so the orphan check knows them.
@@ -457,7 +457,7 @@ function lintFile(file) {
               for (const lf of readdirSync(layoutsDir).filter(isDefFile)) {
                 const lname = defName(lf);
                 if (!usedLayouts.has(lname))
-                  report("warn", file, `layouts/${lf} is not referenced by any Switch case. An orphan face is unreachable (add a case "${lname}" or delete the file) (docs/design/03)`);
+                  report("warn", file, `layouts/${lf} is not referenced by any Switch case. An orphan face is unreachable (add a case "${lname}" or delete the file) (docs.unoverse.ai/design/components)`);
               }
           }
           // v2 STRAGGLER NUDGE: inside a component that declares a tree, every
@@ -486,14 +486,14 @@ function lintFile(file) {
             ? (viewTree.initial ?? Object.keys(viewTree.states)[0])
             : (mDefault ?? (hasStateBlock ? json.state.defaultState : undefined));
           if (typeof arrival !== "string")
-            report("error", file, `a faced component must declare its base state — a v2 state.view tree \`initial\`, or (legacy) manifest.defaultState / state.defaultState (docs/design/03)`);
+            report("error", file, `a faced component must declare its base state — a v2 state.view tree \`initial\`, or (legacy) manifest.defaultState / state.defaultState (docs.unoverse.ai/design/components)`);
         }
         if (stateFiles.length) {
           const order = Array.isArray(json.stateOrder) ? [...json.stateOrder].sort() : null;
           if (!order || !order.length)
-            report("error", file, `has states/ but no stateOrder in the envelope (docs/design/03)`);
+            report("error", file, `has states/ but no stateOrder in the envelope (docs.unoverse.ai/design/components)`);
           else if (JSON.stringify(order) !== JSON.stringify(stateFiles))
-            report("error", file, `stateOrder and states/*.json must name the same set (docs/design/03)`);
+            report("error", file, `stateOrder and states/*.json must name the same set (docs.unoverse.ai/design/components)`);
         }
       }
     } else {
@@ -502,7 +502,7 @@ function lintFile(file) {
   } else {
     // bare partial (layouts/ states/ components/ blocks/, or an atom). A template
     // layout's TOP-LEVEL node is the app's layout root — the one non-slot home for
-    // `appWidth` (state-owned sizing, docs/design/05).
+    // `appWidth` (state-owned sizing, docs.unoverse.ai/design/apps).
     walkNode(json, file, root, null, /[\\/]layouts[\\/][^\\/]+\.(json|yaml)$/.test(file) && isAppPath(file));
   }
 }

package/vendor/base/lint/design/index.mjs

@@ -1,5 +1,5 @@
 /**
- * The rx definitions linter, as a LIBRARY. Rules in, findings out.
+ * The design definitions linter, as a LIBRARY. Rules in, findings out.
  *
  * Sibling of ../nodes/ and deliberately SEPARATE: this one knows the closed primitive set,
  * the closed style vocabulary, token-only values and Switch discriminants. Merging the two
@@ -9,7 +9,7 @@
  * `yaml` in. Worth keeping now that it sits beside a package that does have dependencies.
  *
  * THE WHOLE BODY IS INSIDE `lintDefinitions`, on purpose. It was a script whose top-level
- * constants derived from the rx root, and two bare blocks that RAN RULES at import time.
+ * constants derived from the design root, and two bare blocks that RAN RULES at import time.
  * As a library that is wrong twice: findings would accumulate between runs, and rules would
  * fire before anyone asked. Function scope makes both impossible rather than merely unlikely.
  *
@@ -26,7 +26,7 @@ import { makeTokensForFile } from "./tokens.mjs";
 
 /**
  * Lint every definition under `designRoot`. Prints nothing, exits nothing.
- * A missing rx folder is REPORTED rather than thrown, so callers get one shape of answer.
+ * A missing design/ folder is REPORTED rather than thrown, so callers get one shape of answer.
  *
  * `options.overlay` maps an absolute path to text that STANDS IN for what is on disk.
  * Studio's editor lints what the developer has typed before it is saved, and the only
@@ -44,19 +44,19 @@ export function lintDefinitions(designRoot, options = {}) {
   };
   const candidates = designRoot ? [resolve(designRoot)] : [resolve("apps/unoverse/design"), resolve("design")];
 
-  /** The monorepo's shapes: the design system at `rx/marketplace/`, or the legacy one
+  /** The monorepo's shapes: the design system at `design/marketplace/`, or the legacy one
    *  with `components/` and `atoms/` loose at the root. */
   const holdsDesignSystem = (p) =>
     existsSync(join(p, "marketplace")) || existsSync(join(p, "components")) || existsSync(join(p, "atoms"));
 
   /**
-   * A DEVELOPER'S rx/ HOLDS ONLY ORG FOLDERS, and looking for the monorepo's shapes there
-   * finds nothing. `rx/<org>/{components,styles,templates}` is what Studio scaffolds and
+   * A DEVELOPER'S design/ HOLDS ONLY ORG FOLDERS, and looking for the monorepo's shapes there
+   * finds nothing. `design/<org>/{components,styles,apps}` is what Studio scaffolds and
    * the only layout a developer ever has, because the design system is INSTALLED rather
-   * than authored (sync-starter.sh keeps `rx/marketplace` out of a project on purpose).
+   * than authored (sync-starter.sh keeps `design/marketplace` out of a project on purpose).
    *
    * So a project could not be linted, and since publishing lints first, it could not be
-   * published either: "no rx/ folder here", naming the rx/ folder it was standing in.
+   * published either: "no design/ folder here", naming the folder it was standing in.
    */
   const holdsOrgs = (p) => {
     if (!existsSync(p)) return false;
@@ -75,36 +75,36 @@ export function lintDefinitions(designRoot, options = {}) {
       });
   };
 
-  const RX = candidates.find((p) => holdsDesignSystem(p) || holdsOrgs(p));
-  if (!RX)
+  const DESIGN_ROOT = candidates.find((p) => holdsDesignSystem(p) || holdsOrgs(p));
+  if (!DESIGN_ROOT)
     return {
-      problems: [{ level: "error", file: candidates[0], msg: `no rx/ folder here (looked in: ${candidates.join(", ")})` }],
+      problems: [{ level: "error", file: candidates[0], msg: `no design/ folder here (looked in: ${candidates.join(", ")})` }],
       homes: [],
     };
 
 // ── tree layout ──
-// New layout: rx/marketplace/{atoms,components,styles} + one top-level folder per
-// org (rx/<org>/). Legacy layout: components/ + atoms/ at the root, orgs under rx/orgs/.
+// New layout: design/marketplace/{atoms,components,styles} + one top-level folder per
+// org (design/<org>/). Legacy layout: components/ + atoms/ at the root, orgs under design/orgs/.
 // The DESIGN SYSTEM is the primary lint target; org folders get the SAME generic
 // checks — nothing here may key on a specific org's name.
-// WHERE THE DESIGN SYSTEM ACTUALLY IS. `rx/marketplace/` exists in this monorepo and is
+// WHERE THE DESIGN SYSTEM ACTUALLY IS. `design/marketplace/` exists in this monorepo and is
   // deliberately absent from a developer's project (sync-starter.sh): the platform installs
   // @unoverse-platform/marketplace, whose `definitions/` bundle carries components, atoms
   // AND styles (bundle-defs.mjs). All three matter — the space-scale check reads
   // styles/base/spacing, so a fallback finding only components would build a PARTIAL scale
   // and reject valid steps, reporting false errors on correct work. Mirrors definitions.ts.
   const DS = (() => {
-    const onDisk = join(RX, "marketplace");
+    const onDisk = join(DESIGN_ROOT, "marketplace");
     if (existsSync(onDisk)) return onDisk;
-    const nodesHome = resolve(RX, "..", "nodes");
+    const nodesHome = resolve(DESIGN_ROOT, "..", "nodes");
     for (const c of [
       join(nodesHome, "marketplace", "definitions"),
-      join(resolve(RX, "..", "plugins"), "node_modules", "@unoverse-platform", "marketplace", "definitions"),
+      join(resolve(DESIGN_ROOT, "..", "plugins"), "node_modules", "@unoverse-platform", "marketplace", "definitions"),
     ])
       if (existsSync(c)) return c;
-    return RX; // none anywhere: shared refs will not resolve, and the findings will say so
+    return DESIGN_ROOT; // none anywhere: shared refs will not resolve, and the findings will say so
   })();
-const legacyOrgsDir = join(RX, "orgs");
+const legacyOrgsDir = join(DESIGN_ROOT, "orgs");
 const orgDirs = (() => {
   if (existsSync(legacyOrgsDir))
     return readdirSync(legacyOrgsDir)
@@ -112,16 +112,16 @@ const orgDirs = (() => {
       .map((e) => join(legacyOrgsDir, e))
       .filter((d) => statSync(d).isDirectory());
   // THE LEGACY LAYOUT, where the design system IS the root: `components/` and `atoms/`
-  // sit directly in rx/, so listing children here would lint "components" as an org.
+  // sit directly in design/, so listing children here would lint "components" as an org.
   //
-  // NOT `DS === RX`, which was the same test until the design system stopped being
-  // guaranteed. DS falls back to RX when no design system is found ANYWHERE, which is the
+  // NOT `DS === DESIGN_ROOT`, which was the same test until the design system stopped being
+  // guaranteed. DS falls back to DESIGN_ROOT when no design system is found ANYWHERE, which is the
   // ordinary state of a developer's project — so that test read "this is the legacy
   // layout" and returned no orgs, silently linting nothing at all.
-  if (existsSync(join(RX, "components")) || existsSync(join(RX, "atoms"))) return [];
-  return readdirSync(RX)
+  if (existsSync(join(DESIGN_ROOT, "components")) || existsSync(join(DESIGN_ROOT, "atoms"))) return [];
+  return readdirSync(DESIGN_ROOT)
     .filter((e) => !e.startsWith(".") && e !== "marketplace" && e !== "_schema")
-    .map((e) => join(RX, e))
+    .map((e) => join(DESIGN_ROOT, e))
     .filter((d) => statSync(d).isDirectory());
 })();
 
@@ -290,7 +290,7 @@ const checkDimension = (file, where, key, v) => {
     // or the scale drifts straight back to two vocabularies for the same number — which is
     // the state the t-shirt aliases left it in, and the reason they were retired.
     if (PAGE_WIDTH_KEYS.has(key) && layoutAlias.has(val))
-      report("error", file, `${where}.${key}: "${val}" has a name — use "${layoutAlias.get(val)}". A page-level width reads as what it IS; a bare step here puts two spellings on one value (docs/design/06)`);
+      report("error", file, `${where}.${key}: "${val}" has a name — use "${layoutAlias.get(val)}". A page-level width reads as what it IS; a bare step here puts two spellings on one value (docs.unoverse.ai/design/styles-and-tokens)`);
     // A shorthand ("auto auto 0 0" on `inset`) is a list of dimensions; each word is one.
     for (const word of val.trim().split(/\s+/)) {
       if (spaceSteps.has(word) || DIMENSION_LITERALS.has(word)) continue;
@@ -298,7 +298,7 @@ const checkDimension = (file, where, key, v) => {
       // percentage value; LAW 1 owns those, and `calc()`/`%` are legitimate escape hatches.
       if (/^\d/.test(word) && !/^\d+(\.\d+)?$/.test(word)) continue;
       if (/[()%]/.test(word)) continue; // calc(), min(), clamp(), 50%
-      report("error", file, `${where}.${key}: "${word}" is not a step on the space scale. Invalid values fall through as broken CSS (auto sizing). Real steps: ${stepList()} (docs/design/06)`);
+      report("error", file, `${where}.${key}: "${word}" is not a step on the space scale. Invalid values fall through as broken CSS (auto sizing). Real steps: ${stepList()} (docs.unoverse.ai/design/styles-and-tokens)`);
     }
   }
 };
@@ -329,7 +329,7 @@ const checkToken = (file, where, key, v) => {
     report(
       "error",
       file,
-      `${where}.${k}: "${val}" is not a ${bucket} token. Unknown names are handed to CSS verbatim and dropped — the style simply does not apply, with no error anywhere${extra}. Known: ${[...T[bucket]].sort().join(", ") || "none"} (docs/design/06)`,
+      `${where}.${k}: "${val}" is not a ${bucket} token. Unknown names are handed to CSS verbatim and dropped — the style simply does not apply, with no error anywhere${extra}. Known: ${[...T[bucket]].sort().join(", ") || "none"} (docs.unoverse.ai/design/styles-and-tokens)`,
     );
 
   // The straightforward one-bucket keys (background/color/shadow/radius*/font/lineHeight).
@@ -354,9 +354,9 @@ const checkToken = (file, where, key, v) => {
     const parts = v.trim().split(/\s+/);
     const [w, c] = parts.length > 1 ? parts : [null, parts[0]];
     if (w !== null && !T.borderWidth.has(w))
-      report("error", file, `${where}.${key}: "${w}" is not a border-width token (the leading word of "<width> <colour>"). Known: ${[...T.borderWidth].sort().join(", ") || "none"} (docs/design/06)`);
+      report("error", file, `${where}.${key}: "${w}" is not a border-width token (the leading word of "<width> <colour>"). Known: ${[...T.borderWidth].sort().join(", ") || "none"} (docs.unoverse.ai/design/styles-and-tokens)`);
     if (!LITERAL_VALUES.has(c) && !T.color.has(`border.${c}`) && !T.color.has(c))
-      report("error", file, `${where}.${key}: "${c}" resolves to no colour token (tried border.${c}, then ${c}). The border renders with no colour and nothing reports it (docs/design/06)`);
+      report("error", file, `${where}.${key}: "${c}" resolves to no colour token (tried border.${c}, then ${c}). The border renders with no colour and nothing reports it (docs.unoverse.ai/design/styles-and-tokens)`);
     return;
   }
 
@@ -407,7 +407,7 @@ const dsComponentNames = new Set(
     .filter((e) => !e.name.startsWith("."))
     .map((e) => (e.isDirectory() ? e.name : defName(e.name)).toLowerCase()),
 );
-// The ORG tier's component names, per org (docs/unoverse/UNOVERSE_COMPONENT_ORGS.md):
+// The ORG tier's component names, per org (docs.unoverse.ai/design/components):
 // a Ref may also resolve an org component — bare from inside that org's own tree (the
 // resolver's context rule), or org-qualified as `<org>/<name>` when two orgs share the
 // name. Org-privacy holds: a file only ever reaches its OWN org's components, and a
@@ -449,7 +449,7 @@ const refResolves = (ref, file) => {
  *
  * Ref lookup above is case-insensitive on purpose, and the marketplace is not: an item is
  * fetched as `items/<kind>/<key>.json` over HTTP, off a case-sensitive host. So a name that
- * disagrees with itself resolves forever in `rx/` and 404s the moment anyone installs it.
+ * disagrees with itself resolves forever in `design/` and 404s the moment anyone installs it.
  *
  * That is not hypothetical. 2026-08-06: twelve atoms were unreachable from every universe
  * because git held `Avatar.json` while the build wrote `avatar.json`. macOS is
@@ -457,7 +457,7 @@ const refResolves = (ref, file) => {
  * served what git held. The error surfaced as `could not fetch atom/avatar (HTTP 404)` in
  * the Installed view, months after the cause.
  *
- * Nothing in `rx/` could have caught it, because `rx/` was correct. What was missing was a
+ * Nothing in `design/` could have caught it, because `design/` was correct. What was missing was a
  * rule that the key agrees with itself EXACTLY, which is what this checks:
  *
  *   filename === `name:` === every Ref that points at it
@@ -494,7 +494,7 @@ const canonicalRef = (ref) => canonicalKeys.get(ref.toLowerCase()) ?? null;
  * That silence has cost real screens. `form-toggle` declares `on` and `description`; a
  * form wrote `props: { value: … }` and `with: { help: … }`, so the switch bound to nothing
  * and the sub-line simply never appeared. Everything rendered, nothing was wrong to look
- * at, and the control did not move. Nothing in rx/ could catch it because every node was
+ * at, and the control did not move. Nothing in design/ could catch it because every node was
  * structurally valid.
  *
  * So the keys are checked against the atom's own `props` block. Read lazily and cached:
@@ -576,7 +576,7 @@ for (const orgDir of orgDirs) {
 
 // ── component-name uniqueness (per tier, no marketplace shadowing) ──
 // Names are unique WITHIN a home: two orgs may ship the same name (each addressed
-// `unoverse://components/<org>/<name>` — docs/unoverse/UNOVERSE_COMPONENT_ORGS.md),
+// `unoverse://components/<org>/<name>` — docs.unoverse.ai/design/components),
 // but an org may never SHADOW a marketplace name, so a bare ref stays unambiguous:
 // bare = the marketplace tier, or the single org that carries the name.
 {
@@ -591,7 +591,7 @@ for (const orgDir of orgDirs) {
       const name = (statSync(p).isDirectory() ? e : isDefFile(e) ? defName(e) : null)?.toLowerCase();
       if (!name) continue;
       if (out.has(name))
-        report("error", p, `component name "${name}" already exists at ${relative(RX, out.get(name))}. Names are UNIQUE within a home; rename one`);
+        report("error", p, `component name "${name}" already exists at ${relative(DESIGN_ROOT, out.get(name))}. Names are UNIQUE within a home; rename one`);
       else out.set(name, p);
     }
     return out;
@@ -601,7 +601,7 @@ for (const orgDir of orgDirs) {
     for (const [name, p] of namesIn(join(orgDir, "components"))) {
       const shadowed = marketplaceNames.get(name);
       if (shadowed)
-        report("error", p, `component name "${name}" shadows the marketplace component at ${relative(RX, shadowed)}. An org may never shadow a marketplace name (bare refs must stay unambiguous); rename the org component`);
+        report("error", p, `component name "${name}" shadows the marketplace component at ${relative(DESIGN_ROOT, shadowed)}. An org may never shadow a marketplace name (bare refs must stay unambiguous); rename the org component`);
     }
   }
 }
@@ -627,7 +627,7 @@ for (const orgDir of orgDirs) {
         report(
           "error",
           mf,
-          `org "${org}" has ${defaults.length} apps with "default": true. An org has exactly ONE default app (its /mcp/${org} front door). Keep it on one manifest, remove it from the others (docs/unoverse/UNOVERSE_MCP_APP_PROTOCOL.md §4b)`,
+          `org "${org}" has ${defaults.length} apps with "default": true. An org has exactly ONE default app (its /mcp/${org} front door). Keep it on one manifest, remove it from the others (docs.unoverse.ai/design/apps §4b)`,
         );
   }
 
@@ -635,7 +635,7 @@ for (const orgDir of orgDirs) {
 // A component may run server-side code at a platform fire point, and the safety of that
 // rests on the manifest and the thing that runs agreeing. Both halves are checked here so
 // a bad declaration is caught in the terminal and at publish, not by silence at run time.
-// Mirrors server/tests/rx/lifecycle-declaration.test.ts (UNOVERSE_AUTHORING.md §3c).
+// Mirrors apps/unoverse/server/tests/design/lifecycle-declaration.test.ts (UNOVERSE_AUTHORING.md §3c).
 const KNOWN_LIFECYCLES = new Set(["onStart", "onEnterView"]);
 const PHASES_WITH_LAYOUTS = new Set(["onEnterView"]); // phases that fire per VIEW
 const PLATFORM_HANDLERS = new Set(["getDetail"]); // named handlers needing no file
@@ -648,7 +648,7 @@ const LATCH_KEYS = new Set(["title", "background", "color"]);
 // silently disable every rule after it.
 const credentialDefs = new Set();
 {
-  const nodesHome = resolve(RX, "..", "nodes");
+  const nodesHome = resolve(DESIGN_ROOT, "..", "nodes");
   try {
     for (const pkg of readdirSync(nodesHome)) {
       try {
@@ -658,7 +658,7 @@ const credentialDefs = new Set();
       }
     }
   } catch {
-    /* no nodes tree beside rx: the rule cannot judge, so it stays quiet */
+    /* no nodes tree beside design/: the rule cannot judge, so it stays quiet */
   }
 }
 
@@ -690,7 +690,7 @@ for (const orgDir of [DS, ...orgDirs]) {
 
     for (const e of entries) {
       if (!KNOWN_LIFECYCLES.has(e.phase))
-        report("error", mf, `lifecycle "${e.phase}" is not a phase the platform fires, so it would never run. Known: ${[...KNOWN_LIFECYCLES].join(", ")} (docs/unoverse/UNOVERSE_AUTHORING.md §3c)`);
+        report("error", mf, `lifecycle "${e.phase}" is not a phase the platform fires, so it would never run. Known: ${[...KNOWN_LIFECYCLES].join(", ")} (docs.unoverse.ai/unoverse/UNOVERSE_AUTHORING §3c)`);
       if (e.layouts !== undefined && !PHASES_WITH_LAYOUTS.has(e.phase))
         report("error", mf, `lifecycle "${e.phase}" declares layouts, but only ${[...PHASES_WITH_LAYOUTS].join(", ")} fires per view — the scope would be ignored`);
       // WHAT RUNS is named by `handler`; the phase only says WHEN. A custom hook is a
@@ -759,7 +759,7 @@ for (const orgDir of [DS, ...orgDirs]) {
         if (T) {
           for (const k of ["background", "color"])
             if (typeof latch[k] === "string" && latch[k].trim() && !T.color.has(latch[k]))
-              report("error", mf, `latch.${k}: "${latch[k]}" is not a colour token. Unknown names reach CSS verbatim and are dropped, so the pill renders unstyled with no error anywhere. Known: ${[...T.color].sort().join(", ") || "none"} (docs/design/06)`);
+              report("error", mf, `latch.${k}: "${latch[k]}" is not a colour token. Unknown names reach CSS verbatim and are dropped, so the pill renders unstyled with no error anywhere. Known: ${[...T.color].sort().join(", ") || "none"} (docs.unoverse.ai/design/styles-and-tokens)`);
         }
 
         /**
@@ -791,13 +791,13 @@ function checkCondition(vw, file, where) {
   if (typeof vw === "string") return; // bare truthy field
   if (vw && typeof vw === "object" && !Array.isArray(vw)) {
     if (typeof vw.field !== "string")
-      report("error", file, `${where}: condition needs a "field" (docs/design/04)`);
+      report("error", file, `${where}: condition needs a "field" (docs.unoverse.ai/design/state)`);
     const extra = Object.keys(vw).filter((k) => !CONDITION_KEYS.has(k));
     if (extra.length)
-      report("error", file, `${where}: illegal condition key(s) ${extra.join(", ")}. Only eq/ne/in/truthy exist; no and/or/arithmetic (derive in the node) (docs/design/03)`);
+      report("error", file, `${where}: illegal condition key(s) ${extra.join(", ")}. Only eq/ne/in/truthy exist; no and/or/arithmetic (derive in the node) (docs.unoverse.ai/design/components)`);
     return;
   }
-  report("error", file, `${where}: visibleWhen must be a field name or { field, eq|ne|in } (docs/design/04)`);
+  report("error", file, `${where}: visibleWhen must be a field name or { field, eq|ne|in } (docs.unoverse.ai/design/state)`);
 }
 
 // ── per-node structural walk ──
@@ -847,8 +847,8 @@ function appSizesForFile(file) {
   return appSizesCache.get(home);
 }
 
-// The universal component names (rx/components/*, case-insensitive) — for validating a
-// template manifest's `preview` map. null = the file is not under an rx tree.
+// The universal component names (design/marketplace/components/*, case-insensitive) — for
+// validating an app manifest's `preview` map. null = the file is not under a design tree.
 const componentNamesCache = new Map();
 // Components an ORG's template may reference: the marketplace tier + that org's OWN
 // components — never another org's (org-privacy). Cached per org.
@@ -873,7 +873,7 @@ function componentNamesForFile(file) {
   // The run context: everything the extracted rule modules close over. Built here so it
   // cannot outlive the run, and passed once rather than threaded as ten parameters.
   const ctx = {
-    RX, DS, orgDirs, report, spaceSteps, stepList, checkDimension, checkToken, checkCondition,
+    DESIGN_ROOT, DS, orgDirs, report, spaceSteps, stepList, checkDimension, checkToken, checkCondition,
     appSizesForFile, componentNamesForFile, refResolves, canonicalRef, declaredProps, atomsDirExists,
     isFixture, isHook, isManifest, isAppPath, defRoot, readText,
   };
@@ -881,7 +881,7 @@ function componentNamesForFile(file) {
   const lintFile = makeLintFile({ ...ctx, walkNode });
 
   for (const home of homes) for (const f of jsonFiles(home.dir)) lintFile(f);
-  return { problems, homes, designRoot: RX, designSystem: DS };
+  return { problems, homes, designRoot: DESIGN_ROOT, designSystem: DS };
 }
 
 /** True when anything would fail a build. Warnings and hints inform, errors stop. */

package/vendor/base/lint/design/tokens.mjs

@@ -18,7 +18,7 @@
  * the marketplace foundation's `base` + `semantic` first, then the org's ON TOP, per token
  * — an org omits a token to inherit it. Themes are UNIONED rather than resolved one at a
  * time, because a name that resolves under `dark` is legitimate work; per-theme parity is
- * a different rule with its own guard (server/tests/rx/theme-contract.test.ts).
+ * a different rule with its own guard (apps/unoverse/server/tests/design/theme-contract.test.ts).
  *
  * UNREADABLE IS NOT EMPTY. A developer's project has no design system on disk — it is
  * installed, not authored — so the foundation half cannot be read and only the org's own
@@ -88,7 +88,7 @@ function buildTokens(dsStyles, homeStyles) {
    *
    *  - across a home's own themes, because a name only `dark` defines is real work, not a
    *    typo (whether every theme defines every name is a DIFFERENT rule, guarded by
-   *    server/tests/rx/theme-contract.test.ts — this one must not double as a weaker copy);
+   *    apps/unoverse/server/tests/design/theme-contract.test.ts — this one must not double as a weaker copy);
    *  - the foundation's underneath, because the colour contract is the shared one every
    *    org is written against. An org that has no themes folder of its own would otherwise
    *    read as "no colours exist", and the rule would report every colour it uses.

package/vendor/base/lint/design/vocabulary.mjs

@@ -1,7 +1,7 @@
 /**
  * The CLOSED SETS. This file is the linter's ground truth.
  *
- * Mirrors rx/_schema/unoverse.schema.json and the server guards, and UNOVERSE_CONFORMANCE
+ * Mirrors apps/unoverse/design/_schema/unoverse.schema.json and the server guards, and UNOVERSE_CONFORMANCE
  * §5 makes keeping them equal a maintenance rule: "One source for each closed set... Keep
  * them equal or they disagree silently."
  *
@@ -10,12 +10,62 @@
  * without extending the schema and the SDK in the same change.
  */
 
-// ── ground truth (mirrors rx/_schema/unoverse.schema.json + server guards) ──
+// ── ground truth (mirrors design/_schema/unoverse.schema.json + server guards) ──
 export const PRIMITIVES = new Set([
   "Box", "Stack", "Row", "Column", "Each", "Switch", "ComponentSlot", "Timeline",
   "Text", "Image", "Button", "Input", "Select", "Markdown", "Skeleton", "Icon", "Ref", "Orb",
 ]);
 export const CONDITION_KEYS = new Set(["field", "eq", "ne", "in"]);
+
+/**
+ * WHAT EACH PRIMITIVE IS (UNOVERSE_CONFORMANCE §2a, UNOVERSE_PRIMITIVE_CONTRACT.md).
+ *
+ * Until 2026-08-23 nothing stated this. Every node shared one bag of 36 optional properties,
+ * so `{ type: "Image", bind: { value: photo } }` saved, linted, published and drew nothing —
+ * the silent class behind "the card streams its title but keeps its mock image".
+ *
+ * Merged from three sources: `core/types.ts` JSDoc (25 of 32 properties already named their
+ * owner in prose, where no tool could read it), the renderer (the only authority on which
+ * `bind` keys are consumed), and what shipped definitions actually use — types.ts was
+ * missing nine properties in live use, because YAML never meets a TypeScript interface.
+ *
+ * `packages/sdk/conformance/tools/build-primitive-schema.mjs` reads THIS to emit the JSON
+ * Schema halves, so the editor squiggle and the publish gate cannot disagree.
+ */
+export const UNIVERSAL_PROPS = new Set([
+  // read for every node before dispatch; `brief` rides the tree for the composer
+  "type", "style", "visibleWhen", "bind", "action", "analytics", "skeleton", "brief", "$include",
+]);
+
+export const PRIMITIVE_PROPS = {
+  Box: ["children", "autoScroll", "revealOnStick", "selection", "appWidth"],
+  Stack: ["children", "autoScroll", "revealOnStick", "appWidth"],
+  Row: ["children", "autoScroll", "revealOnStick", "appWidth"],
+  Column: ["children", "autoScroll", "revealOnStick", "appWidth"],
+  Text: ["value"],
+  Image: ["src", "alt"],
+  Markdown: ["value", "inheritLinkColor"],
+  Icon: ["icon", "name"],
+  Skeleton: ["variant"],
+  Orb: ["state", "size"],
+  Button: ["children", "value", "label", "icon", "disabledWhen"],
+  Input: ["placeholder", "inputType", "disabledWhen", "maxLength", "multiline", "rows",
+          "inputMode", "autoComplete", "advanceOnFill"],
+  Select: ["placeholder", "options", "disabledWhen"],
+  Each: ["template", "app", "items"],
+  Switch: ["on", "cases", "fallback"],
+  Ref: ["ref", "props", "with", "children", "name"],
+  ComponentSlot: ["select", "frame", "fallback", "pinned", "appWidth"],
+  Timeline: ["user", "assistant", "userData", "assistantData", "autoScroll"],
+};
+
+/** Which `bind` keys each primitive's view actually reads. Absent = the view reads the whole
+ *  bind object (Orb), so any key is legitimate. */
+export const PRIMITIVE_BINDS = {
+  Text: ["value"], Image: ["src", "alt"], Markdown: ["value"], Icon: ["name"],
+  Button: ["label"], Input: ["value", "placeholder"], Select: ["options", "value"],
+  Each: ["items"],
+};
 // the portable style vocabulary — every key the SDK interpreter maps (sdk/style.ts).
 // Each is a neutral intent every native renderer (iOS/Android/RN/Flutter) implements;
 // an unknown key is a typo or a web-ism that renders nowhere.

package/vendor/base/lint/design/walk.mjs

@@ -14,7 +14,7 @@
  */
 import { existsSync, statSync, readdirSync, readFileSync } from "node:fs";
 import { join, dirname, basename, relative, sep } from "node:path";
-import { PRIMITIVES, CONDITION_KEYS, STYLE_KEYS, RAW_VALUE, CHILD_NODE_KEYS, PARTIAL_DIRS, DIMENSION_KEYS } from "./vocabulary.mjs";
+import { PRIMITIVES, CONDITION_KEYS, STYLE_KEYS, RAW_VALUE, CHILD_NODE_KEYS, PARTIAL_DIRS, DIMENSION_KEYS, UNIVERSAL_PROPS, PRIMITIVE_PROPS, PRIMITIVE_BINDS } from "./vocabulary.mjs";
 import { isDefFile, defName, defPath, readDef } from "./defs.mjs";
 
 export function makeWalkNode(ctx) {
@@ -29,25 +29,45 @@ function walkNode(node, file, root, widthCap = null, isLayoutRoot = false) {
     const a = defPath(root, node.$include);
     const b = join(root, node.$include);
     if (!a && !existsSync(b))
-      report("error", file, `$include "${node.$include}" does not resolve under ${relative(process.cwd(), root)}/ (docs/design/03)`);
+      report("error", file, `$include "${node.$include}" does not resolve under ${relative(process.cwd(), root)}/ (docs.unoverse.ai/design/components)`);
     return; // the included file is linted on its own
   }
 
   const t = node.type;
   if (typeof t !== "string")
-    report("error", file, `node without "type" (and no $include). Every node names a primitive (docs/design/02)`);
+    report("error", file, `node without "type" (and no $include). Every node names a primitive (docs.unoverse.ai/design/sdui-and-mcp-apps)`);
   else if (!PRIMITIVES.has(t))
-    report("error", file, `unknown primitive "${t}". The set is closed; compose, don't invent (docs/design/02)`);
+    report("error", file, `unknown primitive "${t}". The set is closed; compose, don't invent (docs.unoverse.ai/design/sdui-and-mcp-apps)`);
+
+  // WHAT THIS PRIMITIVE IS (UNOVERSE_CONFORMANCE §2a). Before this existed, every node
+  // shared one bag of 36 optional properties, so a wrong field name was accepted by the
+  // schema AND the lint and only showed up as a blank on screen. A wrong name is never a
+  // judgment call, so this is an error rather than a warning.
+  else if (PRIMITIVE_PROPS[t]) {
+    const own = PRIMITIVE_PROPS[t];
+    for (const k of Object.keys(node))
+      if (!UNIVERSAL_PROPS.has(k) && !own.includes(k))
+        report("error", file, `${t} has no "${k}". It reads ${own.length ? own.map((o) => `"${o}"` ).join(", ") : "no properties of its own"} (docs.unoverse.ai/reference/primitives)`);
+
+    // `bind` maps a target onto a data field, and only some targets are read. Binding a
+    // target the view never looks at is the silent failure this whole rule exists for:
+    // the field streams in correctly and the element keeps drawing its preview default.
+    const reads = PRIMITIVE_BINDS[t];
+    if (reads && node.bind && typeof node.bind === "object" && !Array.isArray(node.bind))
+      for (const k of Object.keys(node.bind))
+        if (!reads.includes(k))
+          report("error", file, `${t} never reads "bind.${k}", so the value would arrive and render nothing. It reads ${reads.map((r) => `"bind.${r}"`).join(", ")} (docs.unoverse.ai/reference/primitives)`);
+  }
 
   if (t === "Switch") {
     if (typeof node.on !== "string" || !node.cases || typeof node.cases !== "object")
-      report("error", file, `Switch needs "on" (the discriminant field) + "cases" (docs/design/04)`);
+      report("error", file, `Switch needs "on" (the discriminant field) + "cases" (docs.unoverse.ai/design/state)`);
     else
       for (const [caseKey, branch] of Object.entries(node.cases)) {
         const vw = branch && typeof branch === "object" ? branch.visibleWhen : undefined;
         const guarded = typeof vw === "string" ? vw : vw && typeof vw === "object" ? vw.field : null;
         if (guarded === node.on)
-          report("error", file, `Switch on "${node.on}" → case "${caseKey}" re-guards its own discriminant. A layer never guards itself; delete the visibleWhen (docs/design/03)`);
+          report("error", file, `Switch on "${node.on}" → case "${caseKey}" re-guards its own discriminant. A layer never guards itself; delete the visibleWhen (docs.unoverse.ai/design/components)`);
       }
   }
   // Each: a `template` + a list — EITHER a literal `items:[]` (hardcoded content,
@@ -55,16 +75,16 @@ function walkNode(node, file, root, widthCap = null, isLayoutRoot = false) {
   if (t === "Each") {
     const hasList = Array.isArray(node.items) || (node.bind && typeof node.bind === "object" && node.bind.items);
     if (!node.template || !hasList)
-      report("error", file, `Each needs "template" + a list. Literal "items": [...] or "bind": { "items": "<field>" } (docs/design/03)`);
+      report("error", file, `Each needs "template" + a list. Literal "items": [...] or "bind": { "items": "<field>" } (docs.unoverse.ai/design/components)`);
   }
   if (t === "Ref") {
     if (typeof node.ref !== "string")
-      report("error", file, `Ref needs "ref": "<atom name>" (docs/design/03)`);
+      report("error", file, `Ref needs "ref": "<atom name>" (docs.unoverse.ai/design/components)`);
     else if (atomsDirExists && !refResolves(node.ref, file))
       report("error", file, `Ref "${node.ref}". No matching atom, shared component, or own-org component (bare, or "<org>/<name>" for the file's OWN org only — org-privacy); lookup is case-insensitive by name`);
     // RESOLVES IS NOT ENOUGH. Ref lookup ignores case; the marketplace fetches
     // items/<kind>/<key>.json off a case-sensitive host. A Ref that differs only in case
-    // renders forever in rx/ and 404s on install (index.mjs, canonicalRef).
+    // renders forever in design/ and 404s on install (index.mjs, canonicalRef).
     else if (canonicalRef) {
       const exact = canonicalRef(node.ref);
       if (exact && exact !== node.ref)
@@ -96,7 +116,7 @@ function walkNode(node, file, root, widthCap = null, isLayoutRoot = false) {
               file,
               `Ref "${node.ref}" ${key === "props" ? "remaps" : "passes"} "${name}", which the atom does not declare. ` +
                 `Both \`props\` and \`with\` are matched BY NAME against the atom's own props, and an unknown key is ` +
-                `silently ignored: the element renders and does nothing. ${node.ref} declares: ${known} (docs/design/03)`,
+                `silently ignored: the element renders and does nothing. ${node.ref} declares: ${known} (docs.unoverse.ai/design/components)`,
             );
           }
         }
@@ -109,9 +129,9 @@ function walkNode(node, file, root, widthCap = null, isLayoutRoot = false) {
     checkToken(file, t, "icon", node.icon);
   if (t === "ComponentSlot") {
     if (!node.select || typeof node.select !== "object")
-      report("error", file, `ComponentSlot needs "select" ({} for the conversation flow) (docs/design/05)`);
+      report("error", file, `ComponentSlot needs "select" ({} for the conversation flow) (docs.unoverse.ai/design/apps)`);
     else if (node.select.from === "all" && !node.select.type && !node.select.where)
-      report("warn", file, `global ComponentSlot (from:"all") with no "type" and no "where". Selects OLDEST-first; a trap in a multi-turn surface. Filter by "where" (the reaction contract, §5b) or pin "type", unless the shell is deliberately catch-all (docs/design/05)`);
+      report("warn", file, `global ComponentSlot (from:"all") with no "type" and no "where". Selects OLDEST-first; a trap in a multi-turn surface. Filter by "where" (the reaction contract, §5b) or pin "type", unless the shell is deliberately catch-all (docs.unoverse.ai/design/apps)`);
     // STATE-SELECTED UI (STATE_MODEL §5): a reaction surface reacts to the component's
     // PUBLIC state — the `view` axis (`defaultState` = legacy alias) — never to a
     // component's internal state (step/phase/…) which is private to the component.
@@ -122,16 +142,16 @@ function walkNode(node, file, root, widthCap = null, isLayoutRoot = false) {
     // claim exactly ONE view by `eq` — `ne`/`in`/bare selects make "which state is
     // the template in?" ambiguous.
     else if (node.select.where && (node.select.where.field === "view" || node.select.where.field === "defaultState") && typeof node.select.where.eq !== "string")
-      report("error", file, `a reaction surface claims exactly ONE view: select.where needs "eq": "<view>": ne/in/bare make the template's active state ambiguous (docs/design/04)`);
+      report("error", file, `a reaction surface claims exactly ONE view: select.where needs "eq": "<view>": ne/in/bare make the template's active state ambiguous (docs.unoverse.ai/design/state)`);
   }
 
-  // STATE-OWNED SIZING (docs/design/05): every PANEL states its width once via
+  // STATE-OWNED SIZING (docs.unoverse.ai/design/apps): every PANEL states its width once via
   // `appWidth`; the app is the sum of the open ones. A plain node = always open (the
   // core chat column); a reaction-surface ComponentSlot = open while occupied; a
   // visibleWhen pane = open while its condition matches.
   if (node.appWidth !== undefined) {
     if (typeof node.appWidth !== "string" || node.appWidth.trim() === "")
-      report("error", file, `"appWidth" must be a CSS width string ("360px", "min(50vw, 760px)") or a named app size ("chat", "rail", "panel") (docs/design/05)`);
+      report("error", file, `"appWidth" must be a CSS width string ("360px", "min(50vw, 760px)") or a named app size ("chat", "rail", "panel") (docs.unoverse.ai/design/apps)`);
     // `flex` is contract vocabulary, not a token: the surface takes the REMAINING
     // host space (the SDK reports a full-width app while it is active).
     // Any other bare name is a STANDARD SIZE — it must exist in the org's
@@ -140,17 +160,17 @@ function walkNode(node, file, root, widthCap = null, isLayoutRoot = false) {
     else if (node.appWidth !== "flex" && /^[a-z][a-z0-9-]*$/i.test(node.appWidth)) {
       const sizes = appSizesForFile(file);
       if (sizes && !(node.appWidth in sizes))
-        report("error", file, `"appWidth": "${node.appWidth}" names no app size. Use "flex", a CSS width, or a name from styles/semantic/app-sizes (known: ${Object.keys(sizes).join(", ") || "none"}) (docs/design/05)`);
+        report("error", file, `"appWidth": "${node.appWidth}" names no app size. Use "flex", a CSS width, or a name from styles/semantic/app-sizes (known: ${Object.keys(sizes).join(", ") || "none"}) (docs.unoverse.ai/design/apps)`);
     }
     if (t === "ComponentSlot" && !(node.select && node.select.where))
-      report("error", file, `"appWidth" on a ComponentSlot without select.where. Only a reaction surface can slide out; the flow slot never sizes the app (docs/design/05)`);
+      report("error", file, `"appWidth" on a ComponentSlot without select.where. Only a reaction surface can slide out; the flow slot never sizes the app (docs.unoverse.ai/design/apps)`);
     // ONE declaration per panel: the SDK sizes the frame FROM appWidth (width +
     // flex: 0 0 auto) — a frame width/flex alongside it is dead duplication that
     // can silently disagree.
     if (t === "ComponentSlot" && node.frame && node.frame.style) {
       for (const dup of ["width", "flex"])
         if (node.frame.style[dup] !== undefined)
-          report("error", file, `panel frame declares style.${dup} alongside appWidth. The panel states its width ONCE; the SDK sizes the frame from appWidth. Remove the frame ${dup} (docs/design/05)`);
+          report("error", file, `panel frame declares style.${dup} alongside appWidth. The panel states its width ONCE; the SDK sizes the frame from appWidth. Remove the frame ${dup} (docs.unoverse.ai/design/apps)`);
     }
   }
 
@@ -161,7 +181,7 @@ function walkNode(node, file, root, widthCap = null, isLayoutRoot = false) {
   if (node.brief !== undefined) {
     const b = node.brief;
     if (typeof b !== "string" && (typeof b !== "object" || b === null || Array.isArray(b)))
-      report("error", file, `"brief" must be a string (the description) or { description, maxLength | minItems/maxItems } (docs/design/03)`);
+      report("error", file, `"brief" must be a string (the description) or { description, maxLength | minItems/maxItems } (docs.unoverse.ai/design/components)`);
     else if (typeof b === "object") {
       // description/maxLength/minItems/maxItems COMPILE into the tool inputSchema. `hydrate` is a
       // NON-schema brief annotation (a hydration hook naming what to hydrate) — a valid brief key
@@ -172,24 +192,24 @@ function walkNode(node, file, root, widthCap = null, isLayoutRoot = false) {
       const BRIEF_KEYS = new Set(["description", "maxLength", "minItems", "maxItems", "hydrate", "optional"]);
       for (const k of Object.keys(b))
         if (!BRIEF_KEYS.has(k))
-          report("error", file, `brief.${k} is not part of the brief contract. Only description / maxLength / minItems / maxItems / optional (schema) or hydrate (hydration hook) are allowed (docs/design/03)`);
+          report("error", file, `brief.${k} is not part of the brief contract. Only description / maxLength / minItems / maxItems / optional (schema) or hydrate (hydration hook) are allowed (docs.unoverse.ai/design/components)`);
       if (b.description !== undefined && typeof b.description !== "string")
-        report("error", file, `brief.description must be a string. It IS the schema field's description (docs/design/03)`);
+        report("error", file, `brief.description must be a string. It IS the schema field's description (docs.unoverse.ai/design/components)`);
       if (b.optional !== undefined && typeof b.optional !== "boolean")
-        report("error", file, `brief.optional must be a boolean (docs/design/03)`);
+        report("error", file, `brief.optional must be a boolean (docs.unoverse.ai/design/components)`);
       if (b.hydrate !== undefined && typeof b.hydrate !== "string")
-        report("error", file, `brief.hydrate must be a string (names the field/source to hydrate) (docs/design/03)`);
+        report("error", file, `brief.hydrate must be a string (names the field/source to hydrate) (docs.unoverse.ai/design/components)`);
       for (const nk of ["maxLength", "minItems", "maxItems"])
         if (b[nk] !== undefined && (typeof b[nk] !== "number" || b[nk] < 0 || !Number.isInteger(b[nk])))
-          report("error", file, `brief.${nk} must be a non-negative integer. It compiles to the native JSON Schema keyword (docs/design/03)`);
+          report("error", file, `brief.${nk} must be a non-negative integer. It compiles to the native JSON Schema keyword (docs.unoverse.ai/design/components)`);
       if (typeof b.minItems === "number" && typeof b.maxItems === "number" && b.minItems > b.maxItems)
-        report("error", file, `brief.minItems (${b.minItems}) > maxItems (${b.maxItems}). No composition can satisfy this schema (docs/design/03)`);
+        report("error", file, `brief.minItems (${b.minItems}) > maxItems (${b.maxItems}). No composition can satisfy this schema (docs.unoverse.ai/design/components)`);
       const bound = node.bind && (node.bind.value || node.bind.src);
       const isEach = t === "Each" && node.bind && node.bind.items;
       if (b.maxLength !== undefined && !bound)
-        report("warn", file, `brief.maxLength on a node with no bind. A length cap only compiles when the brief sits next to the bound field it governs (docs/design/03)`);
+        report("warn", file, `brief.maxLength on a node with no bind. A length cap only compiles when the brief sits next to the bound field it governs (docs.unoverse.ai/design/components)`);
       if ((b.minItems !== undefined || b.maxItems !== undefined) && !isEach)
-        report("warn", file, `brief.minItems/maxItems on a non-Each node. Item counts only compile on the Each that binds the array (docs/design/03)`);
+        report("warn", file, `brief.minItems/maxItems on a non-Each node. Item counts only compile on the Each that binds the array (docs.unoverse.ai/design/components)`);
     }
   }
 
@@ -225,12 +245,12 @@ function walkNode(node, file, root, widthCap = null, isLayoutRoot = false) {
       widthCap = widthCap == null ? Number(mw) : Math.min(widthCap, Number(mw));
     const hb = node.style.hideBelow;
     if (typeof hb === "string" && /^\d+$/.test(hb) && widthCap != null && Number(hb) >= widthCap)
-      report("warn", file, `hideBelow "${hb}" ≥ an ancestor maxWidth "${widthCap}". The query can only be satisfied by the surrounding surface, so visibility depends on the host, not the card; lower the threshold below the card's own max width (docs/design/06)`);
+      report("warn", file, `hideBelow "${hb}" ≥ an ancestor maxWidth "${widthCap}". The query can only be satisfied by the surrounding surface, so visibility depends on the host, not the card; lower the threshold below the card's own max width (docs.unoverse.ai/design/styles-and-tokens)`);
     const checkKeys = (obj, where) => {
       for (const k of Object.keys(obj)) {
         if (k === "when") continue; // validated below
         if (!STYLE_KEYS.has(k))
-          report("error", file, `${where}: unknown style key "${k}". The style vocabulary is closed (the cross-platform contract). Typo, or a web-ism that won't port (docs/design/06)`);
+          report("error", file, `${where}: unknown style key "${k}". The style vocabulary is closed (the cross-platform contract). Typo, or a web-ism that won't port (docs.unoverse.ai/design/styles-and-tokens)`);
         else if ((k === "hover" || k === "active") && obj[k] && typeof obj[k] === "object")
           checkKeys(obj[k], `${where}.${k}`);
         else if (DIMENSION_KEYS.has(k)) checkDimension(file, where, k, obj[k]);
@@ -244,15 +264,15 @@ function walkNode(node, file, root, widthCap = null, isLayoutRoot = false) {
     if (node.style.when !== undefined) {
       const w = node.style.when;
       if (!Array.isArray(w))
-        report("error", file, `${t}.style.when must be an array of { field, eq|ne|in, apply } entries (docs/design/04)`);
+        report("error", file, `${t}.style.when must be an array of { field, eq|ne|in, apply } entries (docs.unoverse.ai/design/state)`);
       else
         for (const e of w) {
           if (!e || typeof e !== "object" || typeof e.field !== "string" || !e.apply)
-            report("error", file, `${t}.style.when entry needs "field" + "apply" (docs/design/04)`);
+            report("error", file, `${t}.style.when entry needs "field" + "apply" (docs.unoverse.ai/design/state)`);
           else {
             const extra = Object.keys(e).filter((k) => !CONDITION_KEYS.has(k) && k !== "apply");
             if (extra.length)
-              report("error", file, `${t}.style.when: illegal key(s) ${extra.join(", ")}. Conditions are eq/ne/in/truthy only (docs/design/04)`);
+              report("error", file, `${t}.style.when: illegal key(s) ${extra.join(", ")}. Conditions are eq/ne/in/truthy only (docs.unoverse.ai/design/state)`);
             if (typeof e.apply === "object") checkKeys(e.apply, `${t}.style.when.apply`);
           }
         }