zz-meridian 0.16.0 → 0.16.2

package/README.md

@@ -39,7 +39,9 @@ Brand flags: `--name "Acme Ops"`, `--hex '#2E6BE4'` (or `--accent indigo|cobalt|
 in a page's kicker ("Production"); it does not touch the navigation workspaces.
 
 **adopt** copies Meridian's tokens, styles, components, gates and scripts into `src/`, `tokens/` and `scripts/`;
-merges the dependencies and scripts it needs into your `package.json`; replaces your global stylesheet (yours is kept
+merges the dependencies and scripts it needs into your `package.json`; adds the `@meridian/*` alias to your
+`tsconfig.json` (yours is kept as `tsconfig.before.json` when it carries comments or trailing commas, which JSON
+cannot hold); replaces your global stylesheet (yours is kept
 beside it as `*.before.css`); brands it; adds Meridian's managed block to your `AGENTS.md` between two markers, keeping your own text there byte
 for byte; writes an empty `docs/brief.md` (your product, users, data, decisions and glossary) if you have none; installs the skill into
 `.agents/skills/` (Codex) and `.claude/skills/` (Claude Code); records every Meridian file it copied in `.meridian/manifest.json`;

package/dist/adopt.js

@@ -8,7 +8,7 @@
  */
 import fs from 'node:fs';
 import path from 'node:path';
-import { VERSION, brandArgs, effectiveBrand, inside, installSkill, packageManager, payloadBytes, payloadFiles, readJsonc, readPayload, relativeImports, run, runTool, sha256, writeIn, writeManifest, } from './files.js';
+import { VERSION, brandArgs, effectiveBrand, inside, installSkill, jsoncExtras, packageManager, payloadBytes, payloadFiles, readJsonc, readPayload, relativeImports, run, runTool, sha256, writeIn, writeManifest, } from './files.js';
 import { BRIEF_TEMPLATE, managedBlock, upsertManagedBlock } from './context.js';
 import { FIXED, adoptSetOf, managedPaths } from './ownership.js';
 /** The template's dependencies a dashboard built from these files needs. */
@@ -123,6 +123,39 @@ export default defineConfig({
 });
 `;
 }
+/**
+ * What `adopt` writes for a team's `tsconfig.json`, and what it must say about it: the file Meridian's code needs (its
+ * scripts import with `.ts` extensions, its code is ES2022, `@meridian/*` reaches its files), the team's own kept beside
+ * it when it carries what `JSON.stringify` cannot hold, and what their `@/*` alias stands for. A function rather than a
+ * block inside `adopt` so a test can hold it to those three: a test that ran the whole `adopt` would need the template
+ * the payload carries, which a checkout has only after a build, and it would be testing the copy, not this decision.
+ */
+export function tsconfigWrites(tsPath) {
+    const writes = new Map();
+    const notes = [];
+    const ts = readJsonc(tsPath);
+    ts.compilerOptions ??= {};
+    ts.compilerOptions.allowImportingTsExtensions = true;
+    ts.compilerOptions.noEmit = true;
+    if (!/^es20(2[2-9]|[3-9]\d)|^esnext$/i.test(ts.compilerOptions.target ?? '')) {
+        notes.push(`raised tsconfig target from ${ts.compilerOptions.target ?? 'its default'} to ES2022`);
+        ts.compilerOptions.target = 'ES2022';
+    }
+    ts.compilerOptions.paths ??= {};
+    ts.compilerOptions.paths['@meridian/*'] = ['./src/*'];
+    const at = ts.compilerOptions.paths['@/*']?.[0];
+    const atAlias = typeof at === 'string' ? at.replace(/\/\*$/, '').replace(/^\.\//, '') || '.' : null;
+    // A tsconfig may carry comments and trailing commas, which `next dev` keeps (`comment-json`) and `JSON.stringify`
+    // cannot hold. What the team wrote is kept beside the rewritten file, as the stylesheet and the postcss config are,
+    // rather than dropped in silence — the note says so, and there is no backup to explain when there was nothing to lose.
+    const was = fs.readFileSync(tsPath, 'utf8');
+    writes.set('tsconfig.json', JSON.stringify(ts, null, 2) + '\n');
+    if (jsoncExtras(was)) {
+        writes.set('tsconfig.before.json', was);
+        notes.push('tsconfig.json carried comments or trailing commas, which the rewritten file cannot: yours is tsconfig.before.json');
+    }
+    return { writes, notes, atAlias };
+}
 export function adopt(o) {
     const { root } = o;
     const say = (s) => console.log(s);
@@ -230,20 +263,11 @@ Rename or move them, then run adopt again.`);
     const tsPath = path.join(root, 'tsconfig.json');
     let atAlias = null;
     if (fs.existsSync(tsPath)) {
-        const ts = readJsonc(tsPath);
-        ts.compilerOptions ??= {};
-        ts.compilerOptions.allowImportingTsExtensions = true;
-        ts.compilerOptions.noEmit = true;
-        if (!/^es20(2[2-9]|[3-9]\d)|^esnext$/i.test(ts.compilerOptions.target ?? '')) {
-            notes.push(`raised tsconfig target from ${ts.compilerOptions.target ?? 'its default'} to ES2022`);
-            ts.compilerOptions.target = 'ES2022';
-        }
-        ts.compilerOptions.paths ??= {};
-        ts.compilerOptions.paths['@meridian/*'] = ['./src/*'];
-        const at = ts.compilerOptions.paths['@/*']?.[0];
-        if (typeof at === 'string')
-            atAlias = at.replace(/\/\*$/, '').replace(/^\.\//, '') || '.';
-        writes.set('tsconfig.json', JSON.stringify(ts, null, 2) + '\n');
+        const ts = tsconfigWrites(tsPath);
+        for (const [f, text] of ts.writes)
+            writes.set(f, text);
+        notes.push(...ts.notes);
+        atAlias = ts.atAlias;
     }
     else {
         return fail('no tsconfig.json: Meridian is TypeScript. Add one (next dev writes it), then run adopt again.');

package/dist/cli.js

@@ -7,6 +7,7 @@ import os from 'node:os';
 import path from 'node:path';
 import { parseArgs } from 'node:util';
 import { adopt } from './adopt.js';
+import { misapplied } from './command-flags.js';
 import { create } from './create.js';
 import { BRAND_FLAGS, VERSION, installSkill } from './files.js';
 import { brandCommand } from './rebrand.js';
@@ -75,6 +76,12 @@ function main() {
         console.log(HELP);
         return command || values.help ? 0 : 1;
     }
+    // A flag a command does not read is refused, never ignored: `adopt --dry-run` wrote the project rather than previewing it.
+    const wrong = misapplied(command, flags);
+    if (wrong) {
+        console.error(`zz-meridian ${command}: --${wrong.flag} belongs to ${wrong.belongsTo}`);
+        return 1;
+    }
     if (command === 'adopt')
         return adopt({ root: process.cwd(), brand, allowDirty: Boolean(values['allow-dirty']), install });
     if (command === 'create') {

package/dist/command-flags.js

@@ -0,0 +1,38 @@
+/**
+ * Which flags each command reads. A flag that names a mode or a value belongs to the command that acts on it: anywhere
+ * else it is refused by name rather than accepted and ignored, so `adopt --dry-run` never modifies a project while the
+ * person waits for a preview.
+ */
+import { BRAND_FLAGS } from './files.js';
+/** Every command reads these. */
+const EVERYWHERE = ['help', 'version'];
+/** The brand flags, read by the commands that write a brand. */
+const BRAND = BRAND_FLAGS;
+/** What each command reads, beyond the two above. */
+const ACCEPTS = {
+    adopt: [...BRAND, 'allow-dirty', 'no-install'],
+    create: [...BRAND, 'no-install'],
+    update: ['allow-dirty', 'no-install', 'dry-run', 'resume', 'finalize', 'abort', 'verify', 'verbose'],
+    brand: [...BRAND, 'allow-dirty'],
+    skill: ['global'],
+};
+/** The commands that read one flag, in the CLI's own order, for the sentence that sends the person to the right one. */
+function commandsReading(flag) {
+    return Object.keys(ACCEPTS).filter((c) => ACCEPTS[c].includes(flag));
+}
+/**
+ * The first flag a command does not read, with the command it belongs to; null when every flag is the command's own.
+ * `update` is the one command with no spelling of its own, so a flag only it reads is named as its own.
+ */
+export function misapplied(command, flags) {
+    const accepted = ACCEPTS[command];
+    if (!accepted)
+        return null;
+    for (const [flag, value] of Object.entries(flags)) {
+        if (value === undefined || EVERYWHERE.includes(flag) || accepted.includes(flag))
+            continue;
+        const others = commandsReading(flag);
+        return { flag, belongsTo: others.length ? `zz-meridian ${others.join(' or ')}` : 'no command' };
+    }
+    return null;
+}

package/dist/files.js

@@ -82,10 +82,10 @@ export function runTool(root, entry, args, quiet = true) {
     return spawnSync(process.execPath, [path.join(root, 'node_modules', entry), ...args], { cwd: root, encoding: 'utf8', stdio: quiet ? 'pipe' : 'inherit' });
 }
 export const hasCommand = (cmd) => spawnSync(cmd, ['--version'], { stdio: 'ignore', shell: process.platform === 'win32' }).status === 0;
-/** JSON with the comments and trailing commas a tsconfig may carry. */
-export function readJsonc(file) {
-    const text = fs.readFileSync(file, 'utf8');
+/** A JSONC document's text with the comments dropped, and whether anything had to be dropped to read it. */
+function strippedJsonc(text) {
     let out = '';
+    let dropped = false;
     for (let i = 0, str = false; i < text.length; i++) {
         const c = text[i];
         if (str) {
@@ -102,12 +102,14 @@ export function readJsonc(file) {
             continue;
         }
         if (c === '/' && text[i + 1] === '/') {
+            dropped = true;
             while (i < text.length && text[i] !== '\n')
                 i++;
             out += '\n';
             continue;
         }
         if (c === '/' && text[i + 1] === '*') {
+            dropped = true;
             i += 2;
             while (i < text.length && !(text[i] === '*' && text[i + 1] === '/'))
                 i++;
@@ -116,8 +118,19 @@ export function readJsonc(file) {
         }
         out += c;
     }
-    return JSON.parse(out.replace(/,(\s*[}\]])/g, '$1'));
+    const json = out.replace(/,(\s*[}\]])/g, '$1');
+    return { json, dropped: dropped || json.length !== out.length };
 }
+/** JSON with the comments and trailing commas a tsconfig may carry. */
+export function readJsonc(file) {
+    return JSON.parse(strippedJsonc(fs.readFileSync(file, 'utf8')).json);
+}
+/**
+ * Whether a project's file carries what plain JSON cannot hold: a comment, or a trailing comma. `next dev` writes a
+ * tsconfig through `comment-json`, which keeps both, so a tool that re-serialises one drops what the team's own
+ * toolchain preserves — and this is the question to ask before doing it.
+ */
+export const jsoncExtras = (text) => strippedJsonc(text).dropped;
 /**
  * Meridian's own `@/` imports, made relative to the file. An adopting project may map `@/` somewhere else, or already
  * have a `components/ui/button`; a relative import can never resolve to the team's file instead of Meridian's.

package/dist/migrations.js

@@ -422,7 +422,23 @@ export const RELEASE_MIGRATIONS = [
         instructions: 'The release renamed them with no redirect, and an update writes none of the team\'s pages, views or tests. Each file listed is one of them or names one: a page or a view, the view tools, `src/app.config.ts`\'s nav and the feature ids it names, the routes of `scripts/verify.config.ts`, or a shipped test that expects them. A project that kept the sample\'s pages as they were brings the release\'s over: `app/(dashboard)/` and `app/embed/`, `src/views/`, `src/data/`, `src/lib/assistant/` beside `prompt.ts`, `src/app.config.ts` with its own `app` kept, and each shipped test as the release has it; a file listed here that the release no longer has is deleted. A project that made the pages its own keeps its own names, makes the changes this release\'s other migrations list in them, and reads "not applicable" for the assistant walk-through\'s steps on Home and Now (`scripts/lib/sample.ts`).',
         checks: GATE_AND_BUILD,
     },
+    {
+        id: 'marker-measured-on-observe',
+        since: '0.16.2',
+        applies: railObserverNeverAnswers,
+        summary: 'A test mounts the rail over a `ResizeObserver` whose `observe` answers nothing: the rail takes its first measurement from the observer now, where it took one by hand.',
+        instructions: 'Bring `tests/rail-marker.test.tsx` over from the release as it has it. Since 0.16.2 `src/components/patterns/rail/index.tsx` reads no offset of its own — a rail mounts inside the tap that opens the phone drawer, and a read there lays the page out inside that tap — so the marker\'s first position is the one `observe` delivers, after the effect that called it. A test whose fake answers `observe` with an empty body expects the marker before any delivery and fails; the release\'s fake answers it with the callback, `observe() { for (const cb of observers) queueMicrotask(cb); }`, and reads the marker after that delivery. A test of your own that mounts the rail changes the same way.',
+        checks: ['gate'],
+    },
 ];
+/**
+ * A test of the rail that stands over a fake `ResizeObserver` answering `observe` with nothing (0.16.2). The lookbehind
+ * keeps `unobserve() {}` out of it: a fake that answers the callback and also stubs `unobserve` is the release's own
+ * shape, and the one thing to bring over.
+ */
+function railObserverNeverAnswers(root) {
+    return matching(root, (rel, src) => /\.(?:test|spec)\.tsx?$/.test(rel) && /\bRail\b/.test(src) && /\bResizeObserver\b/.test(src) && /(?<![\w$.])observe\s*\(\s*\)\s*\{\s*\}/.test(src));
+}
 /** The team's files that import an export 0.16.0 removed from a managed module, by name or through a namespace. */
 function removedExportReaders(root) {
     const removed = { 'src/lib/insight': ['deviations', 'largest', 'runs', 'weekendRatio'], 'src/lib/collection': ['queryInput'] };
@@ -511,6 +527,37 @@ function refusalUndeclared(root) {
         return null;
     return /^export const refusal\b/m.test(body) ? null : [rel];
 }
+/** The nav item objects of a nav array, by brace: an object naming an `href` of its own, however many lines it is over. Braces inside a quoted value are not braces. */
+function navItemObjects(nav) {
+    const found = [];
+    const open = [];
+    let quote = null;
+    for (let i = 0; i < nav.length; i++) {
+        const ch = nav[i];
+        if (quote) {
+            if (ch === '\\')
+                i++;
+            else if (ch === quote)
+                quote = null;
+            continue;
+        }
+        if (ch === "'" || ch === '"' || ch === '`')
+            quote = ch;
+        else if (ch === '{')
+            open.push(i);
+        else if (ch === '}') {
+            const start = open.pop();
+            if (start === undefined)
+                continue;
+            const inner = nav.slice(start + 1, i);
+            // What is left once the objects inside it are taken out: a group's `href`s are all in its items, so a group has
+            // none of its own left and is not an item.
+            if (/\bhref\s*:/.test(inner.replace(/\{[^{}]*\}/g, '')))
+                found.push(inner);
+        }
+    }
+    return found;
+}
 /** The project's own nav, with any item still missing the `needs` that 0.13.0 requires of it. */
 function navItemsWithoutNeeds(root) {
     const rel = 'src/app.config.ts';
@@ -520,16 +567,17 @@ function navItemsWithoutNeeds(root) {
     const nav = /export const nav\b[^=]*=\s*\[([\s\S]*?)\n\];/.exec(body)?.[1];
     if (nav === undefined)
         return null;
-    // One item per line, as `adopt` writes them and as a hand-kept nav keeps them, so the item is the line naming its
-    // `href`: a group's opening line — every project groups its nav — names no `href` and carries no `needs` of its own,
-    // so counting it as an item would report a change no edit can settle. Anything the file does beyond that is the
-    // team's own shape, and none of it is read.
-    const items = nav.split('\n').filter((l) => /\bhref\s*:/.test(l));
+    // The item is the object naming its `href`, read by its braces rather than by its line: a team that spreads an item
+    // over its keys put the `needs` two lines below the `href`, and a line-based read reported the migration for a file
+    // with none of the old shape left in it. A group is not a destination and carries no `needs`: its own `href`s belong
+    // to the items inside it, so an object whose braces hold only other objects is not read. Anything the file does
+    // beyond that is the team's own shape, and none of it is read.
+    const items = navItemObjects(nav);
     // A project of 0.12.3's vintage also declares `NavItem` itself, without the property: an item that names a `needs` its
     // own type does not have is the type error the gate prints next, so the change is not done until the type carries it.
     const declaredType = /export type NavItem[^;]*\};/.test(body);
     const typeHasNeeds = /export type NavItem[^;]*\bneeds\s*:/.test(body);
-    return items.some((l) => !/\bneeds\s*:/.test(l)) || (declaredType && !typeHasNeeds) ? [rel] : null;
+    return items.some((item) => !/\bneeds\s*:/.test(item)) || (declaredType && !typeHasNeeds) ? [rel] : null;
 }
 /**
  * The page specifications under a route group of the project's own, at the top of its app folder, that lack the part the

package/dist/rebrand.js

@@ -165,8 +165,19 @@ function attempt(ctx, change, allowDirty) {
 }
 /** The command: the real context, which replays the running release and runs its branding script in scratch. */
 export function brandCommand({ root, flags, allowDirty }) {
-    const scratch = fs.mkdtempSync(path.join(os.tmpdir(), 'zz-meridian-brand-'));
     const log = (line) => (line.startsWith('zz-meridian brand:') ? console.error(line) : console.log(line));
+    // The flags are read before anything is copied, and a value the branding script refuses is refused here with the
+    // command's own sentence: `adopt` and `create` read the same flags through `effectiveBrand` and answer its Error
+    // (`adopt.ts:153`, `create.ts:19`), where `brand` let it out as a stack trace.
+    let brand;
+    try {
+        brand = effectiveBrand(flags);
+    }
+    catch (e) {
+        log(`zz-meridian brand: ${e.message}`);
+        return 1;
+    }
+    const scratch = fs.mkdtempSync(path.join(os.tmpdir(), 'zz-meridian-brand-'));
     const replays = new Map();
     let n = 0;
     try {
@@ -204,7 +215,7 @@ export function brandCommand({ root, flags, allowDirty }) {
                 return fs.readFileSync(path.join(copy, APP_CONFIG), 'utf8');
             },
         };
-        return rebrand(ctx, effectiveBrand(flags), { allowDirty });
+        return rebrand(ctx, brand, { allowDirty });
     }
     finally {
         fs.rmSync(scratch, { recursive: true, force: true });

package/dist/session.js

@@ -265,8 +265,11 @@ function install(ctx, session, j, pm) {
     const { root } = ctx;
     const lock = lockfileFor(root, pm);
     const prior = j.operations.find((o) => o.path === lock && o.disposition === 'team-preserved' && o.applied);
-    const before = prior ? prior.base : probe(root, lock).side;
     const backup = path.join(session, 'backup', lock);
+    // The preimage is what the lockfile was before this update's install, and the first run wrote it here before running
+    // one. A resumed run that probed the project instead takes whatever a killed install left behind as "ours", and an
+    // abort would then put a half-written lockfile back in place of the team's.
+    const before = prior ? prior.base : fs.existsSync(backup) ? sideOf(sha(fs.readFileSync(backup))) : probe(root, lock).side;
     if (before.exists && !fs.existsSync(backup))
         writeAtomic(backup, fs.readFileSync(inside(root, lock)));
     const t0 = performance.now();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zz-meridian",
-  "version": "0.16.0",
+  "version": "0.16.2",
   "description": "Bring ZZ Meridian, a dashboard design system, into a Next.js project, or start a new dashboard on it. Copies the files in; nothing depends on this package at runtime.",
   "license": "MIT",
   "type": "module",

package/payload/CHANGELOG.md

@@ -2,6 +2,63 @@
 
 Every release of ZZ Meridian, newest first. Versions follow semver: a removed or renamed token, prop or card is major; a new card, token or variant is minor; a corrected value is a patch. Each entry says what breaks and what to do instead.
 
+## [0.16.2] · 2026-10-16
+
+### Breaking
+
+- **A created project's shipped test of the rail fails until it is brought over.** `tests/rail-marker.test.tsx` — the template's test of the rail's marker — stands over a `ResizeObserver` whose `observe` answers with nothing, which only worked because the rail read its own offsets as well. That read is what 0.16.2 removed (see **Changed**), so the file now asserts a marker position that nothing has measured yet. The file is the project's own from the moment it is created, so the update does not write it: it reports it as the migration `marker-measured-on-observe`, with the fix — bring the release's `tests/rail-marker.test.tsx` over as the release has it. Its fake answers `observe` with the callback and reads the marker after that delivery; a test of your own that mounts the rail answers `observe` the same way.
+- **The Web Vitals check fails on a dropped frame.** `scripts/vitals.ts` counted frames over 50 ms while its taps played out and printed the number on every line without ever failing on it, so a `verify --full` that passed was not being held to the floor its own header states. It fails now: `frames over 50 ms` must read `0 of N`. Two things about how it counts changed with it. Frames are read **in the tap's own window and no other** — the recording used to run from the moment the page opened, straight through the Escape that closes what a tap opened and the settle after it, which the INP measurement in the same loop already excludes because it is the check's own work and not the person's. And a page that drops one frame is **measured a second time in full** before it is failed, because a single frame in two hundred is inside the noise of the host a four-times throttle is measuring: a page that drops one twice is a page that stutters. A run that was passing still passes; a run that was failing now says so, and names the control the frame was dropped on.
+
+### New
+
+- **`useNavDrawer(asked)`** (`src/components/base/use-nav-drawer.ts`) — whether a navigation drawer is open, for the frame that owns one. It carries the bookkeeping both shells had written for themselves: the drawer opens for every press of the top bar's button that it has not answered yet, remembers the page it opened on so a navigation closes it, and forgets that page when the address moves. The Atlas's copy was missing the last of those, so opening the contents on a phone, following a link and pressing Back re-opened the drawer with nobody pressing anything. A product that wrote the same bookkeeping for a drawer of its own should read it from here.
+
+### Changed
+
+- **The rail reads its own geometry from the observer's first delivery, not by hand.** The rail measured itself with an `offsetTop` read as well as through its `ResizeObserver`, and a rail mounts inside the tap that opens the phone drawer — so that read made the browser lay the whole page out inside the tap: measured at a 50 ms frame on a throttled phone, against 33 ms for the mount alone. The observer's first delivery reports the same numbers after the browser has laid out for itself. Nothing moves while a measurement is missing: the current item draws the same pill itself.
+- **The Atlas's front page names the latest release, not the work toward the next one.** It read the first section of `CHANGELOG.md` — which is `[Unreleased]` while a release is pending, and has no version — so the card showed pending work under the version it was going to be released as. It also read the version, the date and the summary with one pattern that refused the `#` of `### Breaking`, the first line under every heading in that file: the date fell to an empty fallback and the card printed `0.16.2 · ` with nothing after the separator, on every release. The heading and the paragraph are read separately now, and the "Full changelog" link no longer shares the kicker's line.
+- **`AppMark` names its own gradient.** The mark is a client component now, because each draws a sheen whose id has to be its own: a page holds more than one mark (the Atlas draws one in the phone's bar and one in the shelf, both mounted at every width), and a fixed `id` was a duplicate on every one of those pages, with a `url(#…)` naming two elements. A product that overrode the mark's markup rather than its `app.logo` is unaffected; the first load of `/embed/now` in this template moved 809 → 811 KiB.
+
+### Fixed
+
+- **A new dashboard's own `pnpm verify` failed on a test that named the template.** `tests/embed-page-failure.test.tsx` asserts the embed's way out, and wrote the copy out as `Open in ZZ Meridian` — the template's name, while the frame draws `Open in ${app.name}`. Every dashboard is created under its own name, so the test passed in this repository and failed in every project made from it, at the first `pnpm verify` a team runs. It reads the name from `src/app.config.ts` now.
+
+## [0.16.1] · 2026-10-16
+
+### Breaking
+
+- **The literal-colour rule reads more forms.** `scripts/check.ts` matched `#rrggbb`, `#rgb`, `rgb(`/`rgba(` and `hsl(`/`hsla(`. It now reads a hex of four or eight digits too — `#0a5F`, `#0a58caFF` — and `oklch()`, `oklab()`, `lab()`, `lch()` and `color()`. A gate that passed can fail on a line that writes one of them: use a role or a token (`text-ink`, `border-line`, `var(--…)`), or mark the line `allow-literal-colour` where the colour is genuinely a literal of its own, as an embed's simulated host and a third party's brand are. A colour composed from tokens is not a literal and is not reported, so `color-mix(in oklch, var(--ink) 40%, transparent)` stays as it is.
+- **A flag a command does not read is refused, not ignored.** `zz-meridian adopt --dry-run` — and any other flag named outside the command that reads it — exits 1, naming the command it belongs to. A CI step that passed one did nothing quietly; it fails now, which is what it should have done.
+- **A figure nobody measured is `null`, not zero.** `RequestSummary.p95` and `RequestSummary.errorShare` (`src/data/requests.ts`) are `null` when the set is empty, and `MetricTile.points` is `(number | null)[]`; `NowData`'s per-model `p95` and `errorRate` are `null` for a model with no usage row. A page, a fixture or a test of yours that builds one of them adds the `null` case; a tile whose point is `null` draws a gap where it drew a fall to zero, and the request log says "not measured" where it said `0ms` and `0.0%`.
+- **The audit's two truncated-value rules mean what the card contract says.** `scripts/audit.ts` accepted any `title` anywhere near a cut value without comparing it with the text, and read `aria-labelledby` as the attribute's own value instead of resolving the ids it names. Both compare now, so a `verify --full` that passed can fail: put the whole of a cut value in a `title` that *holds* it (a title of something else keeps none of it), and name a real element with `aria-labelledby` — an id that is nowhere is a control with no name. `CONTRIBUTING.md` promised both all along.
+- **The backend gate refuses a data URL it cannot read the host of.** `unsafeBackend` (`scripts/verify.ts`) skipped a value it could not read the host of, which is how a DSN written without a scheme (`user:pass@db.prod.example.com:5432/app`), a password holding a `/` or a `#`, or a libpq line (`host=… user=…`) reached the presses. The authority is read with its credentials dropped, a value whose host still cannot be read is refused rather than skipped, and a host named in the query string is read the way libpq reads it — `postgres:///app?host=db.prod.example.com` reaches that host, since libpq takes the host from the query and lets it override the authority, dials `hostaddr` when both are named, keeps the last value of a keyword it is given twice, and treats `/…` as a Unix socket, which stays local. A file scheme that names a host is another machine's file (`file://db.prod.example.com/share/app.db`) or a database over the network (`libsql://…`) rather than a file of this machine's. A refusal names the way out: point the value at a local copy for the run, or set `allowRemoteData: true` in `scripts/verify.config.ts`.
+
+### New
+
+- **`readAll(name, q)`** (`src/data/read.ts`) answers with every row a collection holds, asking the same question of every page: a list that counts, totals or claims "every" starts there, and a `limit` passed to it is ignored, because its answer means every row. `readEndpoints`, `readServices` and the incident read that joins each ticket go through it, and so do the Members and the Keys view tools and the three pages that list them: the endpoint list, the incidents the bell and Services count, every member, every key and every service are now all of them, where each was the first hundred. A page of yours that read one page of a collection and called it every row reads through `readAll` too.
+
+### Changed
+
+- **Home says no service is monitored yet.** A services read that succeeded and returned no rows had the page's title and its line say "every service is operational" while the page's own fact said "0 of 0 operational". Both say the empty state now, in the words the Services and Now pages already use.
+- **`adopt` keeps a commented tsconfig beside the rewritten one.** `adopt` rewrites `tsconfig.json` to raise the target and add the `@meridian/*` path, and `JSON.stringify` cannot hold a comment or a trailing comma. When the team's file carries either, it is kept as `tsconfig.before.json` and the notes say so; a plain tsconfig gets no backup.
+- **`brand` reports a flag it cannot use.** `brand --theme purple` printed an uncaught `Error` where `adopt` and `create` answer the same value with a sentence. All three report it the same way now, before anything is copied.
+- **The standard names three motion loops.** The token layer defines three (`--dur-loop-spin`, `--dur-loop-shimmer`, `--dur-loop-pulse`) and the Motion floor and the Skeleton card named two. All three are named everywhere now, and `tests/motion-loops.test.ts` holds the count to the tokens.
+
+### Fixed
+
+- **A held-back answer agrees with itself.** The line an answer ends with when the 3,000-character cap holds part of it back read "1 more line are not shown."; it reads "1 more line is not shown.", and the row messages follow.
+- **A resumed update keeps the lockfile preimage a killed install left behind.** `--resume` probed the project for the team's lockfile, so a lockfile a killed install had rewritten stood in as "ours" and an abort would have put a half-written file back in place of the team's. It comes from the session's backup now.
+- **The prepared query's 3,000-character cap bounds the whole answer.** It bounded the drilled rows, the one part it could shorten, so a summary over budget by itself came back over.
+- **`nav-needs` reads a nav item by its braces.** An item a team had spread over its keys was reported as missing a `needs` that was two lines below its `href`.
+- **Copy says "Copied" only when the copy happened.** A refused clipboard write left the button saying it had copied.
+- **The short date is one function.** `formatShortDate` (`01 Oct`) and `formatDay` (`3 Oct`) in `src/lib/format-date.ts`; six copies of the same expression in five views and a chart preview are gone, and four sentences that wrote the day in two different ways agree.
+- **A project created in another timezone passes its own gate.** A shipped test pinned the template's timezone; it states the project's own now, so `create --timezone Europe/London` no longer fails the gate it ships with.
+- **A credit reads as a credit.** `formatCost` wrote `$-0.0050` for an amount under a cent; the sign goes before the currency, as `-$0.0050`.
+- **Home's focus line states no ratio against a median of zero**, where it printed `NaN×`.
+- **A required control inside a `Field` is announced as required.** A `Select` given `required`, or inside `<Field required>`, carries `aria-required` on its trigger, where nothing announced it.
+- **Three checks in `scripts/` say what they measured.** A failed performance run shows in the coverage line rather than only in the phase; the keyboard walk prints "and the same in reverse" only when it compared the reverse walk; and `audit --atlas` reads its key list from this repository rather than from the folder it was run in. The pagination card's README no longer claims a page size in the address that the table does not keep.
+- **The 0.16.0 section below was corrected in place.** Revenue's own needs were stated twice and one of them wrongly; nothing a product renders changed.
+
 ## [0.16.0] · 2026-10-15
 
 ### Breaking
@@ -34,7 +91,6 @@ Every release of ZZ Meridian, newest first. Versions follow semver: a removed or
 - **A request is priced at its model's price.** `usageOf()` prices a request from the `models` records and from no list of its own: its tokens at its model's prices a million, the price of a call when it reached no model, nothing when it was refused. The list of $3 and $15 a million tokens and $0.10 a thousand calls is gone, so every cost on a request's page moved.
 - **The ticket boundary's refusal for a fixed field has new words.** It reads "A ticket's id, its times and its incident are set by the system and cannot be changed." A test of yours that matches the sentence matches the new one.
 - **Home, Usage and Revenue hand their pages a `head`.** `HomeData`, `UsageData` and `RevenueData` each hold `head`, what the page states at its head: `{ title, facts, unknown? }` (`PageHead` in `src/views/fact-insight.ts`), worked out on the server by the view tool's read. Home's `head.facts` are the facts of a year, and `HomeData` holds `line`, the line under its title, where it held `unwell`. A fixture or a test of yours that builds one of the three adds them: `head: { title: null, facts: [] }` draws a page headed by its name, and `unwell: null` says nothing of the services.
-- **Revenue asks for the days.** `FEATURES.revenue.needs` is `{ allOf: ['customers:read', 'days:read'] }`, because its title reads them. Every role of the sample that reads customers reads the days too. A role of yours that holds `customers:read` alone no longer opens `/business`: grant it `days:read`.
 - **Now and Services hand their pages a `head`.** `NowData` and `ServicesData` each hold `head`, the page's title and the days inside the band (`PageHead` in `src/views/fact-insight.ts`), worked out on the server by the view tool's read. A fixture or a test of yours that builds one of them adds it: `head: { title: null, facts: [] }` draws a page headed by its name.
 - **Now and Services ask for more.** `FEATURES.now.needs` is `{ allOf: ['services:read', 'incidents:read', 'releases:read', 'tests:read', 'days:read', 'usage:read', 'models:read', 'compute:read', 'endpoints:read', 'tickets:read', 'activity:read'] }` and `FEATURES.services.needs` is `{ allOf: ['services:read', 'incidents:read', 'days:read'] }`: Now's title counts the releases in testing, which their verification runs decide, and both contexts count the days inside the band. Every role of the sample that reads the services holds them. A role of yours that does not no longer opens `/engineering` or `/services`: grant it what is missing. Now's eleven are what its read states beside the services, the releases and the days: each model, compute in use, the slowest endpoints, the work and the latest changes.
 - **Now's data states what engineering's parts draw.** `NowData` keeps `services`, `head`, `updatedAt` and `now`, loses `current` and `alsoOpen` (`incidents.open` holds every open incident, the most severe first), and adds `line`, `incidents`, `band`, `models`, `compute`, `shipping`, `work`, `endpoints`, `month`, `runs`, `activity` and `unread`, a part being `null` when its read failed. Build it with `nowData(reads)` from `src/views/now-parts.ts`, as `nowTool` does: a fixture or a test of yours that builds a `NowData` by hand builds it there instead. Now's body and its embed take it packed: `PackedNowBody` in `src/views/now.tsx` and `EmbedNow` in `app/embed/now/view.tsx` take `packNow(data)` from `src/views/now-context.ts`, which sends each strip to the browser one character a day; a page or a test of yours that renders either passes its `NowData` through `packNow` first. Now's context no longer lists every service with its latency: it states the services as their summary and each part's figures.

package/payload/CONTRIBUTING.md

@@ -93,7 +93,7 @@ Write the status on the line under the title: `Status: beta`.
 | `pnpm typecheck`, `pnpm test` | TypeScript and the behaviour tests | Gate |
 | `node scripts/audit.ts` | With the app running: every page and embed view at 2560, 1440, 1024, 768 and 390px in both themes (embeds at 720 and 420 on a simulated host ground). It measures inside open shadow roots too. Fails on sideways scroll, text clipped without an ellipsis, text cut with an ellipsis that keeps the whole of it in no `title`, two pieces of text drawn in the same place or a stroked line drawn through one, a control with no accessible name, more than one page scroller, rendered text under its WCAG minimum (an SVG's text too, read by its `fill` against what the SVG paints behind it), a Tab stop with no focus ring (a change of outline, shadow or border when focus arrives), a custom element it cannot look inside (`unmeasured:`), and any uncaught exception or console error. Prints the design metrics: type sizes, weights, radii and the hierarchy ratio | Before release |
 | `node scripts/audit.ts --atlas` | With the app running: the same audit over the Design Atlas, at 1440 and 390px in both themes: every card's page and its bare preview, and every other entry the Atlas serves (the token views, the page specs, the guides). Its first line says what it reached, by kind, and `--list` prints the routes without opening a browser. Not part of `pnpm verify`, which stays fast: a card's preview is where a defect in its own box shows, so run it after changing a component | After changing a component |
-| `node scripts/vitals.ts [--atlas]` | With a production build running: LCP, INP and CLS on a mid-range phone for every static page, the Atlas's front page and one card page among them. `--atlas` measures every Atlas entry instead, about fifteen minutes, and is not part of `pnpm verify` | Inside `pnpm verify --full`; `--atlas` after changing what every card page shares |
+| `node scripts/vitals.ts [--atlas]` | With a production build running: LCP, INP, CLS and dropped frames on a mid-range phone for every static page, the Atlas's front page and one card page among them. `--atlas` measures every Atlas entry instead, about fifteen minutes, and is not part of `pnpm verify` | Inside `pnpm verify --full`; `--atlas` after changing what every card page shares |
 | `node scripts/interactions.ts` | With the app running: presses every control on every page (mouse at 1440px, taps at 390px) and follows every link. Reaches controls inside open shadow roots. Fails on a control that changes nothing, one something covers, and a link that answers 4xx | Before release |
 | `node scripts/keyboard.ts` | With the app running: Tab through each page until focus comes back round, then Shift+Tab back. Fails on a stop with no focus ring, a control hidden under the sticky bar, a visible control never reached, and a reverse order that differs | Before release |
 | `pnpm verify` | The gate once, one production build, the route policy, the size checks and a smoke of up to three routes on desktop and the phone drawer; ends with a coverage line, and the report is in `out/verify.txt` | Before finishing any change |

package/payload/app/(dashboard)/(home)/README.md

@@ -35,14 +35,14 @@ The page is headed by what its revenue says for the period chosen, worked out by
 | The period is a record: its revenue is higher than that of every earlier whole period of its length, and at least six such periods are kept (`facts.recordNeedsPeriods` in `src/app.config.ts`) | "The highest 30 days yet: $3,300,438.74", then ", the 3rd record in a row" when the periods before it were each a record too. A record's title has no clause about the services |
 | Otherwise, with a period before it | "Revenue is up 25.8% on the 90 days before" ("down"; "Revenue is level with the 90 days before" when the change rounds to 0.0%), then the services' clause |
 | No period comes before it (All) | "$27,710,624.39 of revenue in 360 days", then the services' clause |
-| The services' clause | ", and every service is operational"; ", and Inference API is degraded" (or "is down") for the one service in the worst state any is in; ", and 2 services are degraded" for several. Left out when the services could not be read |
+| The services' clause | As the last clause, ", and every service is operational". As its own sentence after the figures when something is wrong, ". Inference API is degraded" (or "is down") for the one service in the worst state any is in, ". 2 services are degraded" for several, and ". No service is monitored yet" for a read that returned none: the one thing a person may have to act on is not the fourth item of a list. Left out when the services could not be read |
 | The history could not be read, or no day is kept | The page is headed by its name |
 
 In the sample the four periods read "The highest 7 days yet: $810,137.13", "The highest 30 days yet: $3,300,438.74, the 3rd record in a row", "Revenue is up 25.8% on the 90 days before, and Inference API is degraded" and "$27,710,624.39 of revenue in 360 days, and Inference API is degraded". 90 days and All state no record: 360 days hold four whole periods of 90 and one of 360, fewer than a record needs.
 
 ### The line under the title
 
-One line, worked out by `homeLine` in `src/views/home-context.ts`: the customers that have not left, the period's requests and their change, gross margin for a person who may read what compute cost, and the services, each one that is not operational named with its state, those down first. Counts are written at a glance (`formatCompact`). In the sample at 30 days an Owner reads "320 customers, 1.1B requests in 30 days (up 4.7%), a gross margin of 62.4%, and Inference API is degraded." and a Member or a Viewer the same line without the margin clause. A clause whose figures could not be read is left out. What is wrong today is said here whatever the title says: a record's title has no clause about the services.
+One line, worked out by `homeLine` in `src/views/home-context.ts`: the customers that have not left, the period's requests and their change, and gross margin for a person who may read what compute cost, with the services last. Counts are written at a glance (`formatCompact`). A service that is not operational, or a product monitoring none, is the line's own second sentence, after the figures: on a day whose title states a record it is the only place on the page that says what is wrong today. In the sample at 30 days an Owner reads "320 customers, 1.1B requests in 30 days (up 4.7%), and a gross margin of 62.4%. Inference API is degraded." and a Member or a Viewer the same line without the margin clause. A clause whose figures could not be read is left out.
 
 The revenue card and the tiles share the page's Meridian: its dates are the period's complete days, then the day in progress. Point at a day in the revenue chart and the featured figure reads it; at the day in progress its pill says "so far". A tile reads the pointed day only when its points are the Meridian's dates (the Metric tile's rule). While a day is in progress, the Requests, Compute cost and Gross margin tiles have a point for each complete day and none for the day in progress, one short of the Meridian's dates, so they keep the period's figure and a part-day is never read as a whole one. When the latest day kept is complete, no day is in progress, their points are the Meridian's dates, and pointing at a day reads it in those three tiles too.
 

package/payload/app/(dashboard)/engineering/README.md

@@ -11,7 +11,7 @@ Thirteen parts, in this order. Every chart and list is the card named, the page
 | Part | Split | Pattern | Holds |
 |---|---|---|---|
 | 1. Head | | Page frame | Kicker `ZZ Meridian · Production`; the title, a sentence about the services and the releases (below), with the page's name kept in the heading; the line under it (below), then who Engineering is for (`workspaces.engineering.audience`, read from the declaration); Freshness. No action |
-| 2. Days inside the band | full | Featured metric with a Trend chart, line, with `height="fill"` | The page's protagonist, marked `data-protagonist="Days inside the band"` on a wrapper whose display is `contents`: the days inside the band over every complete day kept, 357, its kicker naming of how many ("Days inside the band · of 360 complete days kept"); the steady fact as its finding, the line the context carries ("357 of 360 days inside the band of p95 under 350 ms and errors under 1%; outside it on 17 Aug 2026, 21 Sept 2026 and 22 Sept 2026"); and the p95 of each of the last 360 complete days as its chart. Its Ask asks what stands out in the days inside the band. With the days not read, its place says so; with none kept, it is not drawn |
+| 2. Days inside the band | full | Featured metric with a Trend chart, line, with `height="fill"` | The page's protagonist, marked `data-protagonist="Days inside the band"` on a wrapper whose display is `contents`: the days inside the band over every complete day kept, 357, its kicker naming of how many ("Days inside the band · of 360 complete days kept"); the steady fact as its finding, the line the context carries ("357 of 360 days inside the band of p95 under 350 ms and errors under 1%; outside it on 17 Aug 2026, 21 Sept 2026 and 22 Sept 2026"); and the p95 of each of the last 360 complete days as its chart, with the band drawn as the region under its ceiling (`band`: `{ value: 350, label: 'Band: p95 under 350 ms' }` in `src/app.config.ts`) and a mark on each day outside it (`marks`, from the strip's own states, so the day that left the band on its error rate is marked where its p95 stands inside the region). Its Ask asks what stands out in the days inside the band. With the days not read, its place says so; with none kept, it is not drawn |
 | 3. Services, now | 2/3 | Card with a Status list, `run` | Every service in the team's order with its state, its last 90 days and how long it has run ("Operational for 69 days · its longest in 90"). Past eight services, the ones not operational, then the three with the longest current runs (below). Always a link to Services that names how many there are: "All 6 services" |
 | 4. Open incident | 1/3 | Incident card, under the part's own heading | The incident nobody has resolved, each update timed from its start ("at the start", "after 1.1h"), its owner and its ticket, which opens the Tickets page on it. With several, "Open incidents": one card each, the most severe first and then the newest. With none, one card says so with when the last one was resolved and how long it lasted ("the last was resolved on 17 Aug 2026 and lasted 2.4h") |
 | 5. N of M days inside the band | full | Card with Uptime bars, `lg`, and a list | Titled by its figure, "357 of 360 days inside the band". The last 360 complete days, ending on the latest complete day, a mark for each day outside the band (`facts.band` in `src/app.config.ts`); the share of the days shown inside it, read "99.17% inside the band"; then four facts: the days outside by date, the year of requests beside the range of the median day's p95, p95 on the busiest day yet, and the requests answered without an error |

package/payload/app/(dashboard)/keys/page.tsx

@@ -1,6 +1,6 @@
 import { gate, gatedMetadata, may } from '@/data/access';
 import { ACTIONS } from '@/data/features';
-import { read } from '@/data/read';
+import { readAll } from '@/data/read';
 import { KeysView } from '@/views/keys';
 import type { ApiKey } from '@/data/sample';
 import { createKey, revokeKey } from './actions';
@@ -22,7 +22,7 @@ export function generateMetadata() {
 export default async function KeysPage() {
   const denied = await gate('keys');
   if (denied) return denied;
-  const { rows, observedAt } = await read('keys');
+  const { rows, observedAt } = await readAll('keys');
   const mayCreate = await may(ACTIONS['create-key'].needs);
   const mayRevoke = await may(ACTIONS['revoke-key'].needs);
   return (

package/payload/app/(dashboard)/members/page.tsx

@@ -1,6 +1,6 @@
 import { gate, gatedMetadata, may } from '@/data/access';
 import { invitableRoles, memberAccess, type MemberRowAccess } from '@/data/member-mutations';
-import { read } from '@/data/read';
+import { read, readAll } from '@/data/read';
 import { assignRole, inviteMember, removeMember, setMemberStatus } from './actions';
 import { MembersView } from '@/views/members';
 import type { Member } from '@/data/sample';
@@ -34,7 +34,7 @@ async function workspaceName(): Promise<string | undefined> {
 export default async function MembersPage() {
   const denied = await gate('members');
   if (denied) return denied;
-  const { rows, observedAt } = await read('members', { sort: { field: 'joined', dir: 'desc' } });
+  const { rows, observedAt } = await readAll('members', { sort: { field: 'joined', dir: 'desc' } });
   const members = rows as Member[];
   const [access, roles, workspace] = await Promise.all([
     Promise.all(members.map(async (m): Promise<readonly [string, MemberRowAccess]> => [m.id, await memberAccess(m.id)])).then((entries) => Object.fromEntries(entries)),

package/payload/app/(dashboard)/operations-tickets/page.tsx

@@ -1,6 +1,6 @@
 import { gate, gatedMetadata, may } from '@/data/access';
 import { ACTIONS } from '@/data/features';
-import { read } from '@/data/read';
+import { readAll } from '@/data/read';
 import { readTickets } from '@/data/tickets';
 import { TicketsView } from '@/views/tickets';
 import { createTicket, updateTicket } from './actions';
@@ -27,9 +27,9 @@ export default async function TicketsPage() {
     may(ACTIONS['create-ticket'].needs),
     may(ACTIONS['update-ticket'].needs),
     may('members:read'),
-    read('services'),
+    readAll('services'),
   ]);
-  const people = mayReadMembers ? (await read('members', { limit: 500 })).rows : [];
+  const people = mayReadMembers ? (await readAll('members')).rows : [];
   return (
     <TicketsView
       rows={rows}

package/payload/app/embed/error.tsx

@@ -0,0 +1,30 @@
+'use client';
+
+import { app } from '@/app.config';
+
+/**
+ * The last net in an embed: something threw that the page's own read did not catch (a view that fails to render). It
+ * imports nothing else, and that is the design, not an oversight.
+ *
+ * Measured: an error boundary here that drew the view's frame and an empty state cost 28 KiB on every embed route's
+ * first load — `/embed/now` went 14 KiB past the 820 KiB budget and all three embeds grew 5.8–7.7% — while the same
+ * boundary importing nothing costs none of it, because a segment's error boundary lands in the route's entry chunk and
+ * everything it imports lands with it. So the framed failure is the page's own (it catches a read that threw and draws
+ * the frame and a card), and this is the document underneath it: the product's name, one sentence, and Try again.
+ * `app.config` is the one import, and it is already in the entry chunk of every route that draws the product's mark.
+ */
+export default function EmbedError({ reset }: { error: Error & { digest?: string }; reset: () => void }) {
+  return (
+    <main className="mx-auto flex min-h-dvh max-w-prose flex-col items-start justify-center gap-3 p-8">
+      <p className="t-kicker">{app.name}</p>
+      <p className="text-sm text-ink">This view did not load, and nothing was changed.</p>
+      <button
+        type="button"
+        onClick={reset}
+        className="press hit rounded-md border border-line-strong px-3 py-1.5 text-sm font-medium text-ink hover:bg-fill-hover"
+      >
+        Try again
+      </button>
+    </main>
+  );
+}