zz-meridian 0.16.3 → 0.18.0

package/README.md

@@ -13,11 +13,11 @@ words at the end:
 
 In Claude Code or Codex, send it as a goal (`/goal Run npx zz-meridian@latest skill --global, then …`): the agent keeps
 working until the condition holds, and a separate model checks it after every turn against the hand-over, which quotes
-its evidence. The sentence says what you want; the skill carries how good it has to be. It builds, renders every view
-at phone and desktop width in both themes, scores each one on a scoreboard of floors (measured by `pnpm verify --full`)
-and craft (judged on the renders), and improves it round by round until nothing is weak, deciding what it can find out
-and recording each decision it made for you. You get the finished product, the renders, and the few questions only you
-can answer.
+its evidence. The sentence says what you want; the skill carries how good it has to be. It builds, renders every view at
+phone and desktop width in both themes, scores each one on a scoreboard of floors (measured by
+`pnpm verify --full --timed`) and craft (judged on the renders), and improves it round by round until nothing is weak,
+deciding what it can find out and recording each decision it made for you. You get the finished product, the renders,
+and the few questions only you can answer.
 
 The skill picks the command from what you said and what is in the folder, and names it before running anything:
 `adopt` to change this Next.js App Router project in place ("make this admin panel look professional"), `create` for a
@@ -80,7 +80,7 @@ styles) and `src/app.config.ts` for the new flags and records them in the manife
 refuses when one of those outputs was edited, while an update is open, or on a dirty tree (unless `--allow-dirty`). Run
 it with the version the manifest records. The project's own `pnpm brand` still works, but its changes count as your edits.
 
-Requires Node 22.18 or newer. The default `pnpm verify` runs without Google Chrome and reports the browser checks as not run; `--full` and `--perf` need it.
+Requires Node 22.18 or newer. The default `pnpm verify` runs without Google Chrome and reports the browser checks as not run; `--full`, `--timed` and `--perf` need it.
 
 ## What this package does not do
 

package/dist/context.js

@@ -19,7 +19,8 @@ When it is absent, use the skill's brief template with the person's answers; do
   upgrade: resolve the report and run the pinned finalization command.
 - Before finishing: safely configured \`pnpm verify\` for the default gate/build/smoke path; report any partial coverage.
   Use \`pnpm gate\` alone for static feedback. Do not automatically chain it before verify, which already runs it.
-  Use \`pnpm verify --full\` or \`pnpm verify --perf\` when deep checks are requested; release CI runs both.
+  Use \`pnpm verify --full\` for the exhaustive checks and \`pnpm verify --timed\` for the timed ones (it needs a quiet
+  machine); \`--full --timed\` is the whole standard. The 20-sample \`--perf\` protocol runs only in CI, split by route with \`--shard <i>/<n>\`; locally use \`node scripts/perf.ts --routes <route>\`. Weekly CI runs each tier as its own job.
 - Agents in the product read through authorized collections and write only through an approved Proposal.
 ${END}`;
 /** The brief a team keeps at `docs/brief.md`; its guidance lines equal `BRIEF_GUIDANCE` in the assistant prompt. */

package/dist/create.js

@@ -77,7 +77,7 @@ ${name} is a new Meridian ${VERSION} dashboard in ${root}.
   skill: .agents/skills/zz-meridian (Codex) and .claude/skills/zz-meridian (Claude Code)
 
 Next: follow .agents/skills/zz-meridian/SKILL.md from step 3's brief (the template is fetched and branded): the brief,
-step 4's colour check, then data and the pages, then the loop in references/standard.md until ${pm} run verify --full ends with "the project meets the
+step 4's colour check, then data and the pages, then the loop in references/standard.md until ${pm} run verify --full --timed ends with "the project meets the
 Meridian standard" and no view on the scoreboard is Weak.`);
     return 0;
 }

package/dist/migrations.js

@@ -235,8 +235,8 @@ export const RELEASE_MIGRATIONS = [
         id: 'verify-modes',
         since: '0.5.0',
         applies: removedVerifyFlags,
-        summary: 'verify has three modes, and --quick, --no-vitals and --extra are gone.',
-        instructions: 'Read "Validation" in references/validation.md. Run `pnpm verify` for the bounded default (the gate once, one build, the size checks and a smoke of up to three routes), `pnpm verify --full` for every exhaustive suite and `pnpm verify --perf` for the 20-sample navigation protocol, and replace the removed flags in the script, workflow or shell file. Read the coverage line each run ends with: it says what ran and what did not.',
+        summary: 'verify has four modes, and --quick, --no-vitals and --extra are gone.',
+        instructions: 'Read "Validation" in references/validation.md. Run `pnpm verify` for the bounded default (the gate once, one build, the size checks and a smoke of up to three routes), `pnpm verify --full` for every exhaustive suite, `pnpm verify --timed` for the timed ones (on a quiet machine) and, in CI only, `pnpm verify --perf --shard <i>/<n>` for the 20-sample navigation protocol (`node scripts/perf.ts --routes <route>` narrows it to one route on your machine), and replace the removed flags in the script, workflow or shell file. Read the coverage line each run ends with: it says what ran and what did not.',
         checks: ['gate'],
     },
     {
@@ -411,7 +411,7 @@ export const RELEASE_MIGRATIONS = [
         since: '0.16.0',
         applies: viewToolPagesWithoutAgentDoes,
         summary: 'The specification of a page a view tool renders says what the agent does there.',
-        instructions: 'Read "Prepared queries" in references/agents.md. Under `## Agents` in the README.md of each page a view tool\'s `page` names, add `### What the agent does here`: a line `Protagonist: <the card\'s name>.`, then at least three questions a person on the page asks that its context does not answer alone, each `- "<question>" — <what the prepared query is asked>`, and mark that card on the page with `data-protagonist="<name>"`. `scripts/check.ts` fails the gate on such a page without the part. While a view tool in `src/views/tools.ts` names no page yet (`view-tool-page-explore`), every console page specification without the part is listed: one that no tool comes to name needs nothing.',
+        instructions: 'Read "Prepared queries" in references/agents.md. Under `## Agents` in the README.md of each page a view tool\'s `page` names, add `### What the agent does here`: a line `Protagonist: <the card\'s name>.`, then at least three questions a person on the page asks that its context does not answer alone, each `- "<question>" — <what the prepared query is asked>`, and mark that card on the page with `data-protagonist="<name>"`. `scripts/check.ts` fails the gate on such a page without the part. While a view tool names no page yet (`view-tool-page-explore`), every console page specification without the part is listed: one that no tool comes to name needs nothing.',
         checks: ['gate'],
     },
     {
@@ -454,6 +454,14 @@ export const RELEASE_MIGRATIONS = [
         instructions: "Replace `clock().toISOString().slice(0, 10)` with `dayOf(clock())` (`dayOf` in `src/lib/format-date.ts`) in each file listed: the prepared query's `today` in `app/api/assistant/route.ts`, and `readDays`'s today in `src/data/metrics.ts`. The prompt has told the model today in `app.timezone` all along, while the prepared query and the page cut their periods at the UTC date, so east of UTC after local midnight (west of UTC in the evening) the model's today and its `7d` window's end were a day apart. A day row is kept under its day in `app.timezone`, so a file of your own that compares an instant's day with one — `now.slice(0, 10)`, `at.slice(0, 10)` — asks `dayOf` too. A product whose `app.timezone` is UTC sees no change. A project that kept the sample's views brings `src/views/now-parts.ts`, `src/views/revenue-parts.ts`, `src/views/customer-context.ts`, `src/views/customer.tsx` and `src/views/members.tsx` over from the release.",
         checks: ['gate'],
     },
+    {
+        id: 'verify-tiers',
+        since: '0.17.0',
+        applies: (root) => matching(root, (rel, src) => importsOf(rel, src).some(({ from, names }) => from === 'scripts/lib/coverage' && names.includes('finalOutcome')) && /(?<![\w.$])finalOutcome\(\s*(?!\{)/.test(src)),
+        summary: '`finalOutcome` in `scripts/lib/coverage.ts` takes `{ full, timed }` as its first argument, because verify has a timed tier apart from the full one.',
+        instructions: 'Bring `tests/verify-suite-outcome.test.ts` over from the release as it has it. A file of your own that calls `finalOutcome` passes the tiers, `finalOutcome({ full, timed }, notRun)`, where it passed whether the run was full (`finalOutcome(true, notRun)`): `references/validation.md` describes the tiers, `pnpm verify`, `--full` and `--timed`.',
+        checks: ['gate'],
+    },
 ];
 /**
  * A test of the rail that stands over a fake `ResizeObserver` answering `observe` with nothing (0.16.2). The lookbehind
@@ -472,15 +480,15 @@ function removedExportReaders(root) {
     }));
 }
 /**
- * The specifications of the pages the view tools of `src/views/tools.ts` render, as the gate reads them from 0.16.0,
- * that lack "What the agent does here". While a tool names no page, the gate cannot tell its page, and neither can this:
- * every console page specification without the part is listed then.
+ * The specifications of the pages the view tools render, as the gate reads them from 0.16.0, that lack "What the agent
+ * does here". The registry is `src/views/tools.ts`, and a tool may be defined in any module under `src/` it imports, as
+ * the gate reads them since 0.17.0, so every `src/` module is read. While a tool names no page, the gate cannot tell its
+ * page, and neither can this: every console page specification without the part is listed then.
  */
 function viewToolPagesWithoutAgentDoes(root) {
-    const tools = text(root, 'src/views/tools.ts');
-    if (tools === null)
+    if (text(root, 'src/views/tools.ts') === null)
         return null;
-    const calls = viewToolCalls(tools).filter((k) => !k.has('...'));
+    const calls = teamSources(root).filter((f) => f.rel.startsWith('src/')).flatMap((f) => viewToolCalls(f.src)).filter((k) => !k.has('...'));
     if (calls.length === 0)
         return null;
     const pages = new Set(calls.map((k) => k.get('page')).filter((p) => typeof p === 'string'));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zz-meridian",
-  "version": "0.16.3",
+  "version": "0.18.0",
   "description": "Bring ZZ Meridian, a dashboard design system, into a Next.js project, or start a new dashboard on it. Copies the files in; nothing depends on this package at runtime.",
   "license": "MIT",
   "type": "module",

package/payload/AGENTS.md

@@ -15,6 +15,6 @@ Meridian is a dashboard design system and template: read `README.md` (what it is
 - **Build up, never sideways.** A page arranges patterns; a pattern composes components; a value is a token. Never write a colour, size or shadow that is not a token; `node scripts/check.ts` fails on literal colours and on Tailwind utilities outside Meridian's reset scales (they render nothing).
 - **Tokens** live in `tokens/*.tokens.json` (DTCG 2025.10). `src/styles/tokens.css` and `src/styles/theme.css` are generated: run `pnpm tokens`, never edit them.
 - **A card** is a folder with `index.tsx`, `preview.tsx` (every state, static, labelled) and `README.md` (the anatomy in CONTRIBUTING). After adding one, run `pnpm registry`.
-- **Before finishing**: `pnpm verify` (the gate once, one build, the size checks and a smoke of up to three routes; it ends with a coverage line that says what ran and what did not). For a change to shared components, the shell or data, run `pnpm verify --full`: every route, every control pressed and every link followed, the keyboard walk, the assistant and the live data. Then look at `node scripts/shot.ts <route> --width 1440,390 --theme dark,light`. `pnpm gate` alone is the fast loop while editing.
+- **Before finishing**: `pnpm verify` (the gate once, one build, the size checks and a smoke of up to three routes; it ends with a coverage line that says what ran and what did not). For a change to shared components, the shell or data, run `pnpm verify --full`: every route, every control pressed and every link followed, the keyboard walk, the assistant and the product's own checks; it judges no time. `pnpm verify --full --timed` adds the navigation budgets, the live data and Web Vitals on a quiet machine, and is the whole standard. Then look at `node scripts/shot.ts <route> --width 1440,390 --theme dark,light`. `pnpm gate` alone is the fast loop while editing. `docs/testing.md` is the testing standard: its `## When each runs` says which command runs at which moment, and its `## Rules` say when a red is fixed and when a limit may move.
 - **Agents in the product** read freely and write only through a Proposal; mark agent work with the Agent mark and "via". See `docs/agents.md`.
 - Everything written to the repository is in English.

package/payload/CHANGELOG.md

@@ -2,6 +2,83 @@
 
 Every release of ZZ Meridian, newest first. Versions follow semver: a removed or renamed token, prop or card is major; a new card, token or variant is minor; a corrected value is a patch. Each entry says what breaks and what to do instead.
 
+## [0.18.0] · 2026-10-19
+
+### Breaking
+
+- **The phone the timed suites emulate is one device on every host: the device of Lighthouse benchmark index 800**, the top of Lighthouse's Mid-Tier Mobile bracket. `scripts/vitals.ts` and the navigation journey (`pnpm verify --timed` and `--perf`) measure the host's own index once per run (Lighthouse's `computeBenchmarkIndex`, the median of three readings) and slow the CPU by that index over 800, to one decimal and never below 1, where they slowed it four times on every host. A host whose index is above 3,200 is now slowed more than before and one below it less, so a laptop and a runner whose CPU varies between runs are held to the same phone. Each timed suite prints `phone: this host slowed <rate>x (benchmark index <index> …)`, and `pnpm verify` keeps that line under its navigation and Web Vitals phases. The floors and the budgets are unchanged. A near miss that used to pass on a fast machine is a page to speed up, not a budget to move.
+- **The desktop prefetch cap counts every router prefetch.** It counted only requests carrying `next-router-prefetch: 1`, while Next 16 sends `3` for the runtime shell every link prefetches and `2` for a full prefetch's URL data, so it read a fraction of what the router fetched: Meridian's Home reads 45.3 KiB where it read 8.8 KiB. A project whose landing page now reads over its `budgets.prefetchKb.desktop` either prefetches less from that page or sets the cap from its own measurement.
+- **The whole 20-sample protocol runs only in CI, split by route across runners.** `pnpm verify --perf` and `node scripts/perf.ts` without `--routes` now refuse where `CI` is not `true`, before the gate or Chrome starts: the protocol is 1,800 journeys, an hour and a half of a machine, and a person's machine is never quiet for that long. In CI, split it with `--shard <i>/<n>` (`pnpm verify --perf --shard 2/5`, with `--perf` alone; the shards together run every rail route once), one shard a runner. On your own machine, narrow it to the route in question: `node scripts/perf.ts --base <url> --routes <route>`. A script or agent prompt that ran `pnpm verify --perf` locally runs it in CI instead.
+
+### New
+
+- **A project's own check that judges a time has a tier of its own** ([#48](https://github.com/zhixuan312/zz-meridian/issues/48)). `timedChecks` in `scripts/verify.config.ts` lists browser checks that judge a time: `pnpm verify --timed` runs each with `--base`, alone, after the live data and before Web Vitals, and reports them as the `timedChecks` suite. A check that measured a budget inside `browserChecks`, under the other suites' load, moves to `timedChecks`.
+- **The fake model can call a project's own tools** ([#49](https://github.com/zhixuan312/zz-meridian/issues/49)). `fakeModel` in `scripts/verify.config.ts` lists `{ when, tool, input }` steps: for a question matching `when` (a case-insensitive pattern) the fake model calls `tool` with `input` when the request hands it, so a journey can check that the assistant cites what the page shows. A pattern that does not compile fails `pnpm verify` before the gate.
+- **`scripts/shot.ts --as <persona>`** ([#50](https://github.com/zhixuan312/zz-meridian/issues/50)) signs each page in with that persona's cookie from `scripts/verify.config.ts` and names each file `<route>-<persona>-<width>-<theme>.png`, so a second persona's pages can be shot for a review. An undeclared persona is refused before Chrome starts, and any option of `shot.ts` given no value (`--as` last on the line) is refused rather than shot without it.
+
+### Changed
+
+- **The start guide keeps the shared phone budget.** `/system/start/start-a-dashboard` carried its own phone-shell budget of 300 ms in `scripts/verify.config.ts`, against the shared 250, because its heading measured 243 to 282 ms on the phone. Since the rail's Docs item prefetches the page in full, its warm phone shell reads 28 ms on the machine that set the exception and 59 ms on the scheduled runner, so the exception is gone. A project's own `budget` on a navigation check works as before.
+- **The fake model refuses the key only on the word `fail`.** It refused any message containing `fail`, so a question such as "Which runs failed?" could not be a `fakeModel` step; "Please fail now" is still refused.
+- **Meridian's weekly CI runs each tier as its own job.** `full`, `timed`, `perf` (five shards of the rail routes) and `consumer` run in parallel, each on its own runner and each within half an hour, where one job ran `pnpm verify --full --timed --perf` for over two hours. A red is rerun by its job alone, and a dispatch can name the jobs it runs (`gh workflow run weekly.yml -f jobs=timed`). `docs/testing.md` says a project's own CI runs the perf protocol the same way.
+- **A dropped frame says where its time went.** `scripts/vitals.ts`'s line for a page that drops a frame ends with the longest gap and, from the Long Animation Frames API, how much of it was script (and whose), style and layout, and render, or that no long animation frame covered it, which points at the compositor or the host rather than the page: `longest gap 167 ms: a long animation frame of 185 ms (script 181 ms by BUTTON.onclick, style and layout 0 ms, render 0 ms)`.
+
+### Fixed
+
+- **`tests/explore-runner.test.ts` no longer fails on a busy machine.** Its large-collection case built a million rows to show that a prepared query asks one aggregate and reads no page, which took 2.8 s alone and passed the 30 s test timeout with the other test workers on a loaded host. It builds 120,000 now, and asserts the same calls. A created project keeps its own copy of the test: bring the release's over, or change `1_000_000` to `120_000` and `'750,010'` to `'90,000'`.
+- **Opening the phone drawer and changing a period no longer lay the page out inside the tap.** Opening the navigation drawer focused its first link inside the tap and let the modal's changes to `<body>` (`pointer-events: none`, the scroll lock's scrollbar width) restyle the whole page, and a period change made the segmented control read its option's position inside the same task: each forced the browser to lay out the page before the frame, which dropped a frame of 67 to 118 ms on the scheduled runner's phone. The drawer stays a modal dialog: focus moves into it a frame after it opens and returns to the button that opened it, the shell's frame stops the inherited changes, and the segmented control measures its thumb in a `ResizeObserver` callback, after layout. A frame that holds a drawer (`data-drawer-frame`) now owns its `pointer-events` while the drawer is open. On the scheduled runner, whose style and layout run about twice as slow as its benchmark index says, some pages still drop a frame: the drawer's mount script and the period's re-render are the work left.
+- **A live page no longer reads its collections again right after it loads** ([#53](https://github.com/zhixuan312/zz-meridian/issues/53)). The stream's first open re-read every collection the server had just served, so a page reading one path from two components and the stream asked for it three times a load, and under a slow API those reads held the browser's connections while the next navigation waited. A collection now has an optional `revision()`; `read`, `readAll` and `aggregate` return the revision they read at, a page hands its views those revisions, and the stream's first open sends them as `since`: the stream greets `synced` when nothing moved, and `resync` naming only what did, so no write between the server's read and the stream's subscription is lost. An adapter without `revision()` is resynced on every open, as before.
+- **The standard Metric tile keeps a long label in its title** ([#51](https://github.com/zhixuan312/zz-meridian/issues/51)), as the compact tile does, so the audit no longer reports a cut label through this managed file.
+- **A toggle probe reads the whole of what it watches** ([#52](https://github.com/zhixuan312/zz-meridian/issues/52)). The navigation compared the first 80 characters of each element its `resultSelector` matches, so a control that changes the end of a long row (an inline confirm in its last cell) was reported dead. A `resultSelector` that holds a ticking clock now counts as changing, so point it at what the control changes.
+- **The console rail's Docs link finds the start guide ready.** The rail's Docs item asks for its page in full (`NavItem.prefetch`, a new optional field), since the start guide's article is its page's URL data, which the default App Shell prefetch leaves for after the press: from `/settings` the start guide's desktop shell fell from 77-146 ms to about 30 ms, and on the phone from 262 to 24 ms, at the cost of one prefetch of about 15 KiB on each main-workspace page on the desktop. The rail keeps Next's default for every other item, and compiles in a project whose `NavItem` has no such field. `scripts/live.ts` tells a prefetch from the router's own read by the same rule as the cap.
+- **`node scripts/audit.ts --atlas` no longer reports overlaps on the Atlas pattern pages** (the 0.17.0 known issue). The audit measured `content-visibility: auto` subtrees the browser had not laid out yet; it now renders each such subtree before it measures and waits two frames. A `content-visibility: hidden` subtree is left alone, since it is not drawn.
+- **The presses follow a relative link as a browser does.** `scripts/interactions.ts` skipped every `href` that did not start with `/`, so a relative link that answered 404 passed. It now resolves each link against its page (`linkPath` in `scripts/lib/links.ts`), follows every link to the page's own site, and reports `link <href> (<resolved path>) answers <status>`.
+- **The Services page's uptime strip ends on today in `app.timezone`.** Its days were cut at the UTC date, so east of UTC after local midnight (west of UTC in the evening) the line's last day was a day off from the periods every other part of the page cuts with `dayOf`. A product whose `app.timezone` is UTC sees no change.
+- **The checks no longer fill your Downloads folder.** Every press of an Export button (Home, Revenue and Usage) is a real download, and the browser `scripts/lib/chrome.ts` launches had no download directory of its own, so each `pnpm verify --full` and `--as` saved their CSVs in the person's Downloads folder, outside the temporary profile the run removes. Downloads now go inside that profile and are removed with it. Files an earlier run left there are named `home-<period>.csv`, `revenue-<period>.csv` and `usage-<period>.csv`, with ` (1)`, ` (2)` and so on after them, and can be deleted.
+- **The workspace journeys read a page's heading once the page is there.** `journeys/workspaces.ts` read the heading as soon as the address and the rail were right, which on a loaded machine could be while the page's `loading.tsx` still stood in for it, whose masthead holds the page's name where the record's will be: the customer step failed with `found a page headed "Customer:"`. It now waits while a busy `role="status"` is on the page. A project that kept the sample's journeys brings `journeys/workspaces.ts` over from the release.
+- **The `agent-does-here-section` update item finds a view tool kept in a module of its own.** It read `src/views/tools.ts` alone, so a project updating across 0.16.0 whose tools sat in modules the registry imports was told of no page while the gate, which reads those modules since 0.17.0, failed them. It now reads every module under `src/`.
+- **A page specification's Theme control no longer drops a frame on a phone** (the 0.17.0 known issue). The stage keyed each pane by its theme, so a Dark-to-Light tap unmounted the pane and loaded the whole page again in a new frame inside the tap. Each pane is now keyed by its position: the frame on screen stays mounted and is re-dressed.
+
+### Known issues
+
+- **On Meridian's scheduled runner, `pnpm verify --timed` drops one frame on two pages**: opening `/business`'s phone drawer and changing `/`'s period, in style and layout of 49 and 64 ms that the benchmark index does not calibrate (2 of 30 pages). Both pass on a quiet machine at the standard's phone, and no floor moved for them, so the weekly `timed` job stays red until the pages do less work in the tap. `pnpm verify` and `--full` are not affected.
+
+## [0.17.0] · 2026-10-18
+
+### Breaking
+
+- **`pnpm verify --full` no longer judges a time.** It runs the complete suites: every rail route navigated for its function, the audit, every control pressed and link followed, the keyboard walk, the assistant and the product's own browser checks. The navigation budgets, the live-data suite and Web Vitals moved to the new `pnpm verify --timed`, which runs them alone and last and needs a quiet machine. Only `pnpm verify --full --timed` can end `the project meets the Meridian standard`; a `--full` run with nothing else unrun ends `every check that ran passed; not run: timing, live, vitals; pnpm verify --timed runs them`. A script, workflow or agent prompt that ran `--full` for the whole standard runs `--full --timed` instead; weekly CI runs `pnpm verify --full --timed --perf`. `docs/testing.md` classifies every check by size, type and tier.
+- **`pnpm verify` and `--full` no longer fail a route for being slow.** Their navigation (`scripts/navigate.ts --timing off`) judges whether each route's shell, data and first interaction arrive, never how fast; `pnpm verify --timed` judges the same journeys against `budgets.navigation`. A project that relied on the default smoke to catch a slow route runs `pnpm verify --timed` on a quiet machine.
+- **`pnpm gate` no longer runs `tests/deep-*`**, the browser-fixture tests of the checks, which only this repository has. Its closing line names the command that does: `pnpm exec vitest run tests/deep- --no-file-parallelism`.
+- **The coverage line has new words.** Its depth can be `timed`, `full+timed` or `full+timed+perf`, and its `not run:` list can name `timing`. A script that matched `coverage: full;` for a complete run matches `coverage: full+timed;` and `not run: none`.
+- **`finalOutcome` (`scripts/lib/coverage.ts`) takes `{ full, timed }` in place of a boolean.** A project's own copy of `tests/verify-suite-outcome.test.ts` from before the tiers calls `finalOutcome(true, …)` and failed its update's gate at the type check; the update now reports it as the `verify-tiers` migration. Bring `tests/verify-suite-outcome.test.ts` over from the release, and call `finalOutcome({ full, timed }, notRun)` in a file of your own.
+
+### New
+
+- **A Featured metric can say its period has no number** ([#45](https://github.com/zhixuan312/zz-meridian/issues/45)). `FeaturedFigure.value` is `number | null`, and `points` takes `null` entries. With no number, the figure's line holds `missing`, the caller's words ("No words recorded", "Unavailable"; "Not recorded" by default), a size down and at the figure's own height, so a period without a number draws the same card as one with. A pointed point that is `null` reads the same way. Before this, the only ways through were a false `0`, or `NaN` with a `format` that turned it into a word; a card that did the second can pass `null` and `missing` now.
+
+### Changed
+
+- **`docs/testing.md` is the testing standard.** Above its classification it says what kinds of test there are (size and type), the tiers that combine them, when each runs (while editing, before a commit, before finishing and handing over a change, before a release, when a given kind of change is made, and on a schedule), and the rules a red, a limit and a release follow, with the practice they rest on. A project is advised to follow it and Meridian follows it. `AGENTS.md`, `CONTRIBUTING.md`, `docs/distribution.md` and `references/validation.md` point to it instead of keeping their own account, and `tests/cli-testing-standard.test.ts` keeps its shape.
+
+### Fixed
+
+- **The assistant is told it changes nothing where it is handed no write tool** ([#46](https://github.com/zhixuan312/zz-meridian/issues/46)). The system prompt always said "Your write tools change what this page shows…" and that the person approves each Proposal, even on a page whose collections the assistant may only read, where no write tool is built and no Proposal can follow. `respond` now tells `systemPrompt` whether it handed a write tool (`Audience.writes`). Without one, the prompt says the assistant changes nothing and, asked for any change, gives the page that makes it, or says it is not a change the person can make. With one, it keeps both lines. The shared guidance that no change exists unless a write tool returned one stays in both.
+- **`ask` writes one transcript a page and can ask a detail page on the record you name** ([#47](https://github.com/zhixuan312/zz-meridian/issues/47)). A page with no view tool was named by its folder, a detail page by the folder before its `[id]`, so `/things` and `/things/[id]` both wrote `things.md` and the second overwrote the first. A page without a tool is now named by its whole route (`/things/[id]` is `things-id`), two views that would share a name are told apart by their routes, and a name still shared is refused before anything is asked. `--view` takes the assistant's tool name as well (`view_usage`), and `--path <address>` asks the page that renders that address on that record, rather than on the first row its listing draws, which may be a closed one. The view names from tools defined in modules the registry imports came with #43. A transcript of a page without a tool has a new file name: compare the new file with the old one, under its new name.
+- **Pointing at a Featured metric's chart moves nothing below the figure** ([#44](https://github.com/zhixuan312/zz-meridian/issues/44)). A figure given `points` and no `delta` drew the row under the figure only while a point was pointed at, so the card grew by the point pill's row as the pointer crossed its chart and shrank when it left: measured at 390 px, 380 → 426 px, and a control below moved 46 px with it, enough for a press aimed at it to land on something else. The row is now drawn at rest as a line of its own, holding the pill's place empty, so the card stays 426 px either way however long the point's name.
+- **The gate and `ask` find a view tool kept in a module of its own** ([#43](https://github.com/zhixuan312/zz-meridian/issues/43)). `viewToolPages()` (`scripts/lib/routes.ts`) read the `defineViewTool` calls written in `src/views/tools.ts` alone, so a project that keeps each tool in a module the registry imports got an empty list. `scripts/check.ts` then asked no page for its `### What the agent does here` — green by absence — and `scripts/ask.ts` named every view by its page's folder, never by its tool. It now reads every project module the registry reaches through its imports, by a relative path or a tsconfig alias, an `index` included. A project whose tools sat in such modules can find pages failing `check.ts` that passed before: each is a page a tool names whose specification lacks the part, and the fix is that part.
+- **Home and Revenue are live pages.** Each body registers the collections its feature needs with `useLive`, so `/` and `/business` resync on open, on reconnect and on the safety poll, and `pnpm verify --perf` finds an after-live start for every Home and Business route again: since the rails became per workspace, `/members`, `/customers`, `/usage` and `/requests` had none (`no other rail route registers live data to start from`).
+- **A link probe is pressed once the destination's data is measured.** The navigation measured the data and pressed the probe side by side, so on a route whose link is ready before its ready text (`/business`, while its title still loaded) the press could leave before the data counted, and a sample failed `main is there but never shows`. A dead link is still reported.
+- **Switching an Atlas card's theme no longer drops a frame on a phone.** The stage's specimen sections are skipped by style and layout until they near the viewport (`content-visibility: auto`), so the Theme, Accent, Density and Width switches restyle only what is on screen; a chart pattern's specimen holds thousands of elements, and the switch cost one frame of 100 to 160 ms on a mid-range phone.
+- **`pnpm verify --perf` holds a route to the budget its navigation check carries**, as `pnpm verify --timed` already did. A route's own figure (`budget` on its check in `verify.config.ts`) now stands in for the shared warm figure in both suites, through one function (`limitsFor` in `scripts/lib/budgets.ts`), so the two no longer judge one route against two bars: the start guide's phone warm shell is reported against its own 300 ms, not the shared 250 ms. Cold and after-live keep the shared figures.
+- **The Atlas's Contributing page no longer links to a page that answers 404.** It linked `docs/testing.md` relatively, which resolved to `/system/system/docs/testing.md`; the file is now named in backticks, as every other Atlas document names a file, and `tests/cli-atlas-doc-links.test.ts` keeps every document the Atlas serves free of relative links.
+
+### Known issues
+
+- **`node scripts/audit.ts --atlas` reports overlaps on the Atlas pattern pages whose specimen renders with `content-visibility: auto`** (featured metric, metric tile, column chart, heatmap and the records template). The pages draw nothing overlapping: the audit measures sections the browser has not laid out yet. Fixed in the next release. `pnpm verify` and its tiers are not affected.
+- **`node scripts/vitals.ts --atlas` can drop one frame on a page specification's look control** (`/system/pages/revenue`, one run in three), where the stage restyles its console and phone frames in one tap. Fixed in the next release. `pnpm verify --timed` is not affected.
+
+
 ## [0.16.3] · 2026-10-17
 
 ### Breaking

package/payload/CONTRIBUTING.md

@@ -82,25 +82,29 @@ Write the status on the line under the title: `Status: beta`.
 
 ## Tools
 
+`docs/testing.md` is the testing standard: the kinds of test, the tiers that combine them, when each runs, the rules a red, a limit and a release follow, and each check's size, type, tier and cost. The When column below uses its moments.
+
 | Command | What it does | When |
 |---|---|---|
-| `pnpm gate` | Every check below, in order | Before every commit |
+| `pnpm gate` | Every check below, in order; the deep tests (`tests/deep-*`) are left out | Before every commit |
 | `pnpm tokens` | Generates the token CSS and the Tailwind bridge from `tokens/` (`--check` only compares) | After any token change |
 | `node scripts/contrast.ts [--all]` | Every specified foreground on its background, in every theme and accent, and the chart palette's colour-vision checks | Gate |
 | `node scripts/registry.ts` | Regenerates the Atlas registry from the card folders (`--check` only compares) | After adding or renaming a card |
 | `rm -rf .next` before the next build, after editing a card's `README.md` | A production build in a working `.next` can serve the prerendered copy of the old text while the client hydrates the new one, which React reports as error #418 on that Atlas page. `pnpm dev` has no such copy, and a fresh clone (CI, a deployment) has none either | After changing what a card's page says |
 | `node scripts/check.ts` | Every card has its README and preview, every README follows the anatomy, no literal colour in components, every token a spec names exists and is written with its own value, every embed view a document offers is a route, an element that claims a control's role has a key handler, and the specification of every page with a view tool has its **What the agent does here**, with its Protagonist line and three questions in their form | Gate |
 | `pnpm typecheck`, `pnpm test` | TypeScript and the behaviour tests | Gate |
-| `node scripts/audit.ts` | With the app running: every page and embed view at 2560, 1440, 1024, 768 and 390px in both themes (embeds at 720 and 420 on a simulated host ground). It measures inside open shadow roots too. Fails on sideways scroll, text clipped without an ellipsis, text cut with an ellipsis that keeps the whole of it in no `title`, two pieces of text drawn in the same place or a stroked line drawn through one, a control with no accessible name, more than one page scroller, rendered text under its WCAG minimum (an SVG's text too, read by its `fill` against what the SVG paints behind it), a Tab stop with no focus ring (a change of outline, shadow or border when focus arrives), a custom element it cannot look inside (`unmeasured:`), and any uncaught exception or console error. Prints the design metrics: type sizes, weights, radii and the hierarchy ratio | Before release |
-| `node scripts/audit.ts --atlas` | With the app running: the same audit over the Design Atlas, at 1440 and 390px in both themes: every card's page and its bare preview, and every other entry the Atlas serves (the token views, the page specs, the guides). Its first line says what it reached, by kind, and `--list` prints the routes without opening a browser. Not part of `pnpm verify`, which stays fast: a card's preview is where a defect in its own box shows, so run it after changing a component | After changing a component |
-| `node scripts/vitals.ts [--atlas]` | With a production build running: LCP, INP, CLS and dropped frames on a mid-range phone for every static page, the Atlas's front page and one card page among them. `--atlas` measures every Atlas entry instead, about fifteen minutes, and is not part of `pnpm verify` | Inside `pnpm verify --full`; `--atlas` after changing what every card page shares |
-| `node scripts/interactions.ts` | With the app running: presses every control on every page (mouse at 1440px, taps at 390px) and follows every link. Reaches controls inside open shadow roots. Fails on a control that changes nothing, one something covers, and a link that answers 4xx | Before release |
-| `node scripts/keyboard.ts` | With the app running: Tab through each page until focus comes back round, then Shift+Tab back. Fails on a stop with no focus ring, a control hidden under the sticky bar, a visible control never reached, and a reverse order that differs | Before release |
+| `node scripts/audit.ts` | With the app running: every page and embed view at 2560, 1440, 1024, 768 and 390px in both themes (embeds at 720 and 420 on a simulated host ground). It measures inside open shadow roots too. Fails on sideways scroll, text clipped without an ellipsis, text cut with an ellipsis that keeps the whole of it in no `title`, two pieces of text drawn in the same place or a stroked line drawn through one, a control with no accessible name, more than one page scroller, rendered text under its WCAG minimum (an SVG's text too, read by its `fill` against what the SVG paints behind it), a Tab stop with no focus ring (a change of outline, shadow or border when focus arrives), a custom element it cannot look inside (`unmeasured:`), and any uncaught exception or console error. Prints the design metrics: type sizes, weights, radii and the hierarchy ratio | Inside `pnpm verify --full` |
+| `node scripts/audit.ts --atlas` | With the app running: the same audit over the Design Atlas, at 1440 and 390px in both themes: every card's page and its bare preview, and every other entry the Atlas serves (the token views, the page specs, the guides). Its first line says what it reached, by kind, and `--list` prints the routes without opening a browser. Not part of `pnpm verify`, which stays fast: a card's preview is where a defect in its own box shows, so run it after changing a component | After a change to a card, a pattern or the Atlas |
+| `node scripts/vitals.ts [--atlas]` | With a production build running: LCP, INP, CLS and dropped frames on a mid-range phone for every static page, the Atlas's front page and one card page among them. `--atlas` measures every Atlas entry instead, about fifteen minutes, and is not part of `pnpm verify` | Inside `pnpm verify --timed`; `--atlas` after a change to a card, a pattern or the Atlas, on a quiet machine |
+| `node scripts/interactions.ts` | With the app running: presses every control on every page (mouse at 1440px, taps at 390px) and follows every link. Reaches controls inside open shadow roots. Fails on a control that changes nothing, one something covers, and a link that answers 4xx | Inside `pnpm verify --full` |
+| `node scripts/keyboard.ts` | With the app running: Tab through each page until focus comes back round, then Shift+Tab back. Fails on a stop with no focus ring, a control hidden under the sticky bar, a visible control never reached, and a reverse order that differs | Inside `pnpm verify --full` |
+| `pnpm exec vitest run tests/deep- --no-file-parallelism` | The browser-fixture tests of the check scripts: each planted defect is found and each corrected twin passes | After a change to a check script, beside `pnpm verify --full`; Meridian's release runs it |
 | `pnpm verify` | The gate once, one production build, the route policy, the size checks and a smoke of up to three routes on desktop and the phone drawer; ends with a coverage line, and the report is in `out/verify.txt` | Before finishing any change |
-| `pnpm verify --full` | The navigation of every rail route, then every exhaustive suite: the audit, every control pressed and link followed, the keyboard walk, the assistant, the live data and Web Vitals | After a change to shared components, the shell or data, and before release |
-| `pnpm verify --perf` | The 20-sample navigation protocol; combine with `--full` to run both without repeating the gate or the build | When timing is what changed |
+| `pnpm verify --full` | The navigation of every rail route, then every exhaustive suite: the audit, every control pressed and link followed, the keyboard walk, the assistant and the product's own browser journeys; it judges no time | After a change to shared components, the shell or data, and before a change is handed over |
+| `pnpm verify --timed` | The navigation of every rail route with its budgets judged, then the live data and Web Vitals, alone and last. It needs a quiet machine. `pnpm verify --full --timed` is the whole standard, the only run that can end "the project meets the Meridian standard" | After a change that could move a time; with `--full`, before a release of the product, at the release commit |
+| `pnpm verify --perf` | The 20-sample navigation protocol, only in CI, split by route with `--shard <i>/<n>` | Weekly in Meridian's repository (5 shards); narrowed locally, `node scripts/perf.ts --routes <route>`, to diagnose a route |
 | `node scripts/brand.ts --name … [--hue … --chroma …]` | Renames and rebrands a copy in place; a brand hue becomes an accent preset that holds contrast in every theme | Starting a project |
-| `node scripts/shot.ts <routes> --width 1440,390 --theme light,dark [--full]` | Screenshots into `out/shots/` | While designing |
+| `node scripts/shot.ts <routes> --width 1440,390 --theme light,dark [--full]` | Screenshots into `out/shots/` | While editing |
 
 A check is code, and it is wrong in the ways code is. Before a new check, or a change to one, is trusted:
 
@@ -112,8 +116,8 @@ A check is code, and it is wrong in the ways code is. Before a new check, or a c
 ## Releasing
 
 1. Add an entry to `CHANGELOG.md` under a new version. Semver: a removed or renamed token, prop or card is major; a new card, token or variant is minor; a corrected value is a patch. Say in one line what breaks and what to do instead.
-2. `node cli/scripts/set-version.ts <v>`, then `pnpm gate` until it passes. Nothing else runs locally: the release workflow's gates are the proof.
-3. Commit and push to `master`, then dispatch once: `gh workflow run release.yml -f version=<v>`. The workflow gates on the package's own tests (`tests/cli-*`) and the browser-fixture tests of the checks (`tests/deep-*`), one timed default `verify` (whose gate leaves both groups out) and the consumer smoke from the tarball, publishes with provenance, checks the registry's tarball is the tested one, and tags last. `verify --full --perf` runs weekly (`.github/workflows/weekly.yml`), not here.
+2. `node cli/scripts/set-version.ts <v>`, then `pnpm gate` until it passes. Nothing else runs locally: the release workflow's gates are the proof. A release that changes the checks themselves (a check script, a tier, a budget) first meets the `Releases` rule in `docs/testing.md`.
+3. Commit and push to `master`, then dispatch once: `gh workflow run release.yml -f version=<v>`. The workflow gates on the package's own tests (`tests/cli-*`) and the browser-fixture tests of the checks (`tests/deep-*`), one default `verify` within its time limit (whose gate leaves both groups out) and the consumer smoke from the tarball, publishes with provenance, checks the registry's tarball is the tested one, and tags last. `verify --full`, `verify --timed` and `verify --perf` run weekly, each as its own job (`.github/workflows/weekly.yml`), not here.
 
 The `/release` command (`.claude/commands/release.md`) is this procedure as a runbook.
 

package/payload/README.md

@@ -77,8 +77,8 @@ Dark is the default, written on `:root`; the light theme follows the operating s
 | `scripts/` | Generators, gates, `brand.ts` and `verify.ts` (see `CONTRIBUTING.md`) |
 | `skills/zz-meridian/` | The agent skill (Claude Code, Codex) that builds dashboards on this template or brings it into yours, to the standard in `references/standard.md`; how it is evaluated is `docs/skill-evals.md` |
 | `cli/` | The `zz-meridian` npm package: `create`, `adopt`, `update`, `brand` and `skill`, its build, its smoke test and the fixture apps (`docs/distribution.md`) |
-| `.github/workflows/release.yml` | The release, each check once: a timed default verify and the consumer path from the tarball (the release before updated; the last three weekly), then npm with provenance, the registry's bytes and provenance checked, then the tag (`.claude/commands/release.md`) |
-| `.github/workflows/weekly.yml` | Weekly, never at release: `verify --full --perf` (perf a report) and the consumer smoke's recovery and failure cases; nothing waits on it |
+| `.github/workflows/release.yml` | The release, each check once: the default verify within its time limit and the consumer path from the tarball (the release before updated; the last three weekly), then npm with provenance, the registry's bytes and provenance checked, then the tag (`.claude/commands/release.md`) |
+| `.github/workflows/weekly.yml` | Weekly, never at release: one job per tier, `verify --full`, `verify --timed` and `verify --perf` in 5 shards (perf a report) and the consumer smoke's recovery and failure cases; nothing waits on it |
 | `Dockerfile`, `captain-definition` | The demo deployment: the template and the Atlas behind `DEMO_PASSWORD` (`proxy.ts`, `app/sign-in/README.md`), deployed to CapRover from this repository; never in the package |
 
 ## Get a dashboard on Meridian, in one sentence
@@ -90,11 +90,11 @@ words at the end:
 
 In Claude Code or Codex, send it as a goal (`/goal Run npx zz-meridian@latest skill --global, then …`): the agent keeps
 working until the condition holds, and a separate model checks it after every turn against the hand-over, which quotes
-its evidence. The sentence says what you want; the skill carries how good it has to be. It builds, renders every view
-at phone and desktop width in both themes, scores each one on a scoreboard of floors (measured by `pnpm verify --full`)
-and craft (judged on the renders), and improves it round by round until nothing is weak, deciding what it can find out
-and recording each decision it made for you. You get the finished product, the renders, and the few questions only you
-can answer.
+its evidence. The sentence says what you want; the skill carries how good it has to be. It builds, renders every view at
+phone and desktop width in both themes, scores each one on a scoreboard of floors (measured by
+`pnpm verify --full --timed`) and craft (judged on the renders), and improves it round by round until nothing is weak,
+deciding what it can find out and recording each decision it made for you. You get the finished product, the renders,
+and the few questions only you can answer.
 
 You do not choose between the package's commands; the skill does, from what you said and what is in the folder, and
 names the route before it runs anything:
@@ -108,12 +108,13 @@ names the route before it runs anything:
 
 `adopt` copies the components, tokens and gates in, merges the dependencies, brands it, adds Meridian's managed block to
 your `AGENTS.md` (your own text there is kept byte for byte) and an empty `docs/brief.md` for your product's own
-context, and installs the skill into the project. `create` writes a new, branded project with the same skill. The
-agent then does the judgement: building each page on Meridian, and running `pnpm verify` until the project meets the
-standard (`pnpm verify --full` after a change to shared components, the shell or data). It needs Node 22.18+, and
-Google Chrome for the browser checks. If your pages call a live API, say so in the sentence: `verify --full` presses
-every control, Delete included, so the agent builds a fake API first. The package (`cli/`, decision 0009) copies files
-and nothing depends on it afterwards; its commands are in `cli/README.md`.
+context, and installs the skill into the project. `create` writes a new, branded project with the same skill. The agent
+then does the judgement: building each page on Meridian, and running `pnpm verify` until the project meets the standard
+(`pnpm verify --full` after a change to shared components, the shell or data, and `pnpm verify --full --timed`, the
+whole standard, before it hands over). It needs Node 22.18+, and Google Chrome for the browser checks. If your pages
+call a live API, say so in the sentence: `verify --full` presses every control, Delete included, so the agent builds a
+fake API first. The package (`cli/`, decision 0009) copies files and nothing depends on it afterwards; its commands are
+in `cli/README.md`.
 
 ## Privacy and feedback
 
@@ -137,7 +138,8 @@ pnpm install
 pnpm dev                 # the template at /, the Design Atlas at /system
 pnpm gate                # tokens fresh, registry fresh, specs consistent, contrast in every theme and accent, types, tests
 pnpm verify              # the gate once, one production build, the size checks and a smoke of up to three routes
-pnpm verify --full       # every route, every control and link, the keyboard walk, the assistant and the live data
+pnpm verify --full       # every route, every control and link, the keyboard walk, the assistant and the product's own checks; no time is judged
+pnpm verify --timed      # the navigation budgets, the live data and Web Vitals; needs a quiet machine, runs alone and last
                          # (the browser suites look inside open shadow roots; validation.md says what each line means)
 pnpm brand --name "Acme" --hue 25 --chroma 0.16   # rename and rebrand in place
 ```

package/payload/app/(dashboard)/(home)/README.md

@@ -74,6 +74,8 @@ Every figure is read on the server by the Home tool's read (`homeTool` in `src/v
 
 The page's client is handed these figures and lines and works nothing out beyond a change against the period before. Revenue is what customers were billed for metered usage, before credits, and over 30 days it is the customers' revenue on Customers and Revenue to the cent; latency is the median day's p95.
 
+The body registers the ten collections its feature needs (`days`, `usage`, `models`, `compute`, `incidents`, `customers`, `services`, `tickets`, `tests` and `releases`) with `useLive` (`src/lib/live.ts`), before the empty state returns, so the page is drawn fresh in every state without a reload. It registers those and no others, because `GET /api/live` answers 403 for any name the caller may not read, and a person who reaches the page may read exactly what its feature needs: `costs`, which the page reads only for a person who may, is not registered. Nothing here writes, so no change hints; the page resyncs on open, on reconnect and on the safety poll.
+
 ## Surfaces
 
 - **Console**: as above.

package/payload/app/(dashboard)/business/README.md

@@ -70,7 +70,7 @@ Every figure is read on the server by the Revenue tool's read (`revenueTool` in
 - **What they buy** is the `usage` rows' revenue by model over the period's complete days, labelled from `models`; **where they are** is the `regions` collection.
 - **`facts.nextPlanAt`** (`src/app.config.ts`, 0.75 in the sample) is read each time the read runs.
 
-Revenue over 30 days equals Home's and the customers' revenue to the cent. Nothing writes.
+Revenue over 30 days equals Home's and the customers' revenue to the cent. Nothing writes. The body registers `customers`, `days`, `usage`, `models` and `regions` with `useLive` (`src/lib/live.ts`), before the empty state returns, so the page is drawn fresh in every state without a reload. Those are the collections its feature needs and no others, because `GET /api/live` answers 403 for any name the caller may not read, and a person who reaches the page may read exactly what its feature needs.
 
 ## Surfaces
 

package/payload/app/(dashboard)/engineering/page.tsx

@@ -60,5 +60,5 @@ async function Lead() {
 /** The parts, their strips packed one character a day for the trip to the browser. */
 async function Body() {
   const { data } = await readNow();
-  return <PackedNowBody {...packNow(data)} />;
+  return <PackedNowBody {...packNow(data)} revisions={data.revisions} />;
 }

package/payload/app/(dashboard)/keys/page.tsx

@@ -22,13 +22,14 @@ export function generateMetadata() {
 export default async function KeysPage() {
   const denied = await gate('keys');
   if (denied) return denied;
-  const { rows, observedAt } = await readAll('keys');
+  const { rows, revision, observedAt } = await readAll('keys');
   const mayCreate = await may(ACTIONS['create-key'].needs);
   const mayRevoke = await may(ACTIONS['revoke-key'].needs);
   return (
     <KeysView
       rows={rows as ApiKey[]}
       now={observedAt}
+      revisions={revision ? { keys: revision } : undefined}
       may={{ create: mayCreate, revoke: mayRevoke }}
       createKey={createKey}
       revokeKey={revokeKey}

package/payload/app/(dashboard)/members/page.tsx

@@ -34,12 +34,12 @@ async function workspaceName(): Promise<string | undefined> {
 export default async function MembersPage() {
   const denied = await gate('members');
   if (denied) return denied;
-  const { rows, observedAt } = await readAll('members', { sort: { field: 'joined', dir: 'desc' } });
+  const { rows, revision, observedAt } = await readAll('members', { sort: { field: 'joined', dir: 'desc' } });
   const members = rows as Member[];
   const [access, roles, workspace] = await Promise.all([
     Promise.all(members.map(async (m): Promise<readonly [string, MemberRowAccess]> => [m.id, await memberAccess(m.id)])).then((entries) => Object.fromEntries(entries)),
     invitableRoles(),
     workspaceName(),
   ]);
-  return <MembersView rows={members} now={observedAt} actions={{ invite: inviteMember, setStatus: setMemberStatus, remove: removeMember, assignRole }} access={access} roles={roles} workspace={workspace} />;
+  return <MembersView rows={members} now={observedAt} revisions={revision ? { members: revision } : undefined} actions={{ invite: inviteMember, setStatus: setMemberStatus, remove: removeMember, assignRole }} access={access} roles={roles} workspace={workspace} />;
 }

package/payload/app/(dashboard)/operations-tickets/page.tsx

@@ -22,7 +22,7 @@ export function generateMetadata() {
 export default async function TicketsPage() {
   const denied = await gate('tickets');
   if (denied) return denied;
-  const [{ rows, observedAt }, mayCreate, mayUpdate, mayReadMembers, services] = await Promise.all([
+  const [{ rows, revisions, observedAt }, mayCreate, mayUpdate, mayReadMembers, services] = await Promise.all([
     readTickets(),
     may(ACTIONS['create-ticket'].needs),
     may(ACTIONS['update-ticket'].needs),
@@ -34,6 +34,7 @@ export default async function TicketsPage() {
     <TicketsView
       rows={rows}
       now={observedAt}
+      revisions={revisions}
       may={{ create: mayCreate, update: mayUpdate }}
       services={services.rows.map((s) => String(s.name))}
       assignees={people.map((m) => ({ id: String(m.id), name: String(m.name) }))}

package/payload/app/(dashboard)/releases/page.tsx

@@ -40,6 +40,6 @@ export default async function ReleasesPage() {
 }
 
 async function ReleaseList() {
-  const { rows, observedAt } = await readReleases();
-  return <ReleasesView rows={rows} now={observedAt} />;
+  const { rows, revisions, observedAt } = await readReleases();
+  return <ReleasesView rows={rows} now={observedAt} revisions={revisions} />;
 }

package/payload/app/(dashboard)/tests/page.tsx

@@ -40,6 +40,6 @@ export default async function TestsPage() {
 }
 
 async function Runs() {
-  const { rows, observedAt } = await readRuns();
-  return <TestsView rows={rows} now={observedAt} />;
+  const { rows, revisions, observedAt } = await readRuns();
+  return <TestsView rows={rows} now={observedAt} revisions={revisions} />;
 }

package/payload/app/api/live/route.ts

@@ -6,7 +6,21 @@ const NAME = /^[A-Za-z0-9_-]{1,64}$/;
 
 const text = (status: number, body: string) => new Response(body, { status, headers: { 'content-type': 'text/plain; charset=utf-8' } });
 
-/** `GET /api/live?collections=members,keys`: change hints for the collections the caller may read. 400 malformed, 401 without a session, 403 for any name they may not read. */
+/** `name:revision,...` into a map; `undefined` when absent, `null` when a pair has no `:`, an empty part or an unnamed collection. */
+function parseSince(raw: string | null, names: string[]): Record<string, string> | undefined | null {
+  if (raw === null) return undefined;
+  const served: Record<string, string> = {};
+  for (const pair of raw.split(',')) {
+    const at = pair.indexOf(':');
+    const name = pair.slice(0, at);
+    const revision = pair.slice(at + 1);
+    if (at < 1 || !revision || !names.includes(name)) return null;
+    served[name] = revision;
+  }
+  return served;
+}
+
+/** `GET /api/live?collections=members,keys`: change hints for the collections the caller may read; `since=members:<revision>` makes the first frame name only what moved. 400 malformed, 401 without a session, 403 for any name they may not read. */
 export async function GET(request: Request): Promise<Response> {
   const scope = await resolveAccess().catch((e: unknown) => { if (e instanceof Unauthenticated) return null; throw e; });
   if (!scope) return text(401, 'Sign in to continue.');
@@ -17,12 +31,16 @@ export async function GET(request: Request): Promise<Response> {
   const names = [...new Set(parts)];
   if (names.length > MAX_NAMES) return text(400, 'Name the collections to follow.');
 
+  const served = parseSince(new URL(request.url).searchParams.get('since'), names);
+  if (served === null) return text(400, 'Name the revisions as name:revision.');
+
   // An unknown name and a forbidden one answer alike, so neither is disclosed.
   if (!(await Promise.all(names.map((n) => can(scope, n, 'read')))).every(Boolean)) return text(403, 'You do not have access to that.');
 
   return liveStream({
     names,
     collections: names.map((n) => collectionFor(scope, n)),
+    since: served,
     signal: request.signal,
     authorize: async (name) => {
       const now = await resolveAccess().catch(() => null);

package/payload/docs/agents.md

@@ -96,6 +96,8 @@ The page text it reads is the scroll region's visible text, less every node mark
 
 A product that replaced one of those pages gets `n/a` with the reason for its steps, decided from its files (`scripts/lib/sample.ts`), and every failure names the part it waited on.
 
+A product checks what the assistant cites with a journey of its own (a script in `browserChecks` in `scripts/verify.config.ts`). To make the fake model call one of the product's view tools for a question, list it in `fakeModel` in the same file: `{ when, tool, input }`, where `when` is a case-insensitive regular expression's source. verify hands the steps to the fake model, which matches them before its own branches, calls `tool` with `input` where the request hands that tool (`I was not handed <tool> here.` where it does not), and answers with the tool's result. A question containing the word "fail" is still refused as a bad key, so a step's `when` should not need it alone.
+
 ## Building an MCP server for the template
 
 The template ships the views and their tool contracts; the server is yours. Every view's contract is in `src/views/tools.ts`: its `name`, the question it answers (`description`), the console route of its page (`page`), its address as a zod `input`, its `resourceUri` when it has an embed route, one `read` that returns what the view renders (`data`) and what both agents are told (`context`), and its prepared query (`explore`), which every view declares. The console's assistant offers each one as `view_<name>`, but registers it only where the caller satisfies that view's need (`may(v.needs)` in `app/api/assistant/route.ts`); register the same list, filtered the same way:

package/payload/docs/benchmark.md

@@ -110,7 +110,7 @@ Those figures were measured before the suites looked inside open shadow roots. A
   - **Patterns:** a column chart left every other category unnamed; the assistant showed nothing between Send and its first words; narrow tiles read "vs previou…"; a read-only form drew its values at 1.5:1; three specimens contradicted their own captions.
   - **Pages:** a phone's record card left separator dots alone on a line and cut dates; Members looked unsorted because the column that explains its order was hidden; the Atlas home numbered its sections 01 to 05, which Meridian's own register rules out.
   - **Extreme values:** fed the largest figures the formatters print, a row of four tiles cut "9,876,543,210" to "9,876,54", a different number with no ellipsis, which no audit flags because the card clips it. A figure past nine characters now reads at a glance ("9.9B", "$1.2M"); the Extreme values specimens hold it. A probe that rewrote every name and figure in tables, lists and records to its longest also found nothing pushed sideways on any route.
-  - **Measured:** `verify --full` on the final commit passes every suite: 0 audit issues on 22 routes at five widths in both themes, 361 controls and 56 links pressed, the keyboard walk, live data, and 18 of 18 pages under LCP 2.5 s, INP 200 ms and CLS 0.1. Web Vitals depend on a quiet machine: with other work holding the load at 11 to 38 on ten cores the same build read 10 to 17 of 18, because the four-times CPU slowdown applies to a host that is already busy; an A/B of the one shell change (the top bar as a container) showed INP tracking the load, not the build. Under reduced motion nothing moves on any route at 1440 or 390px.
+  - **Measured:** `verify --full` on the final commit, when it still ran the live data and Web Vitals (both are `verify --timed`'s now), passes every suite: 0 audit issues on 22 routes at five widths in both themes, 361 controls and 56 links pressed, the keyboard walk, live data, and 18 of 18 pages under LCP 2.5 s, INP 200 ms and CLS 0.1. Web Vitals depend on a quiet machine: with other work holding the load at 11 to 38 on ten cores the same build read 10 to 17 of 18, because the phone's CPU slowdown applies to a host that is already busy; an A/B of the one shell change (the top bar as a container) showed INP tracking the load, not the build. Under reduced motion nothing moves on any route at 1440 or 390px.
 
 ## Open