One look. One voice. Every surface.

PURE is navy and gold — a private-bank palette. Deep navy carries the brand, warm gold is the single accent, and everything else is a small, purposeful set of status colours. Use the token, never a hand-picked colour: when a token changes the whole product follows, and anything hardcoded stays behind.

ARE vs PURE: “ARE” always means Acquisto Real Estate, never the English verb. ARE Blue is reserved for ARE, lane and brokerage moments — it never touches the PURE mark. PURE MLS Technologies is the platform, “by Acquisto”.

Two typefaces do all the work. Folded in from brand/type.html.

Folded in from brand/logo.html and brand/logo-usage.html — two pages nothing linked to, so the rules that keep the mark consistent were reachable only by knowing the URL.

PURE breathes. Consistent, generous spacing is most of what makes it read as a premium tool rather than a crowded dashboard. Folded in from brand/spacing.html.

Alias control pure_icon_alias · live on every rail, no deploy

Fix a live page to standard

Images in PURE earn their place: honest listing photography, consistent persona portraits, and a branded card on every shared link. Folded in from brand/imagery.html.

Prefer the real thing to an illustration, and an illustration to nothing.

<div data-bi-surface="home"></div>
<script src="pure-charts.js"></script>
<script src="pure-livebind.js?v=fix-observer-813"></script>
<script src="pure-bi-embed.js"></script>

The building blocks all live in pure-ui.css (canon design.system.pure_ui_css). Reuse them — do not reinvent spacing, radius or shadow, because a one-off card is a card the theme cannot re-skin.

One wait indicator for the whole product: the animated PURE logo, served from /pure-loader.gif by pure-loader.js. It loads on every page from the ui.globals switchboard, so nothing needs a script tag. A hand-written “Loading…” is not the standard — it is a surface that has not adopted it yet.

Read from pure_component_usage, which tools/component-usage.mjs checks against the repo on every push — a surface that adopts or drops the loader shows up here, and a list that drifts from the code fails the gate. Every entry opens the live page.

A list of 180 organizations is a scroll, not a choice. pure-select.js upgrades any <select> with 8 or more options into a searchable picker, from the ui.globals switchboard — a surface gets it by having a select, not by writing code. The native select stays in the page and stays the value, so forms, .value reads and change listeners are untouched, and if the file never loads every picker still works exactly as before.

One implementation, pure-tabs.js, site-wide from the ui.globals switchboard. A surface adopts it by marking its markup — no script tag, no per-page code:

<div data-pure-tabs="access">
  <button data-tab="hats">Hats</button>
  <button data-tab="fields">Fields</button>
</div>
<div data-tab-panel="hats">…</div>
<div data-tab-panel="fields">…</div>

Page access decides who opens a page. These decide what they see once inside. Set per field on Hat Admin a page Fields; stored in pure_field_policy, applied everywhere by pure-field-guard.js. Default is inherit: if you can open the page, you see the field.

One table everywhere — pure-table.js. PureTable.create builds one from data (including straight from an RPC), PureTable.scan upgrades a plain <table> that is already on the page. Nothing to import: the component ships from the ui.globals switchboard on every page of both shells, so a table is covered by existing rather than by adopting.

The reusable shape for any tracked level-up program — security posture, design-system build-out, standards sweeps. Each item is a card with a have / partial / gap status, an owner, an effort, evidence, and a one-click Advance. Reference implementation: Security Posture .

Admin-editable — add a row, change a status, reassign an owner, rewrite a level-up note. Backed by a registry table + mcp_*_next/_set/_advance RPCs (see the security-posture & design-system specs).

Adopted by Mike 8/16/26 from the exemplar trio — Deal Cockpit (workflow), Navigation Management (admin console), Property Search (data-browse). Not a memo: an engine. Every enabled page is scored on script-checkable points, crons re-score the catalog continuously, results land in pure_design_scores and surface in Site Control. Nothing that a script cannot decide belongs in the rule — which is why each point below carries how it is measured, in the same row that defines it.

Full document: Page compliance — the ten-point standard in the docs library (raw: docs/PAGE-COMPLIANCE.md). Generated from the same row, never hand-edited.

Stub pages are compliant by construction: a small page whose only scripts are pure-boot/pure-shell renders everything at runtime from one source — its surface is the shell config, and it is scored as such rather than as a static page. New pages start from _template-page.html, which scores full marks on every point the day it is copied.

Every date field uses the PURE calendar — navy header, cream accents, line-icon navigation, theme-aware — replacing the off-brand OS control. Drop in any <input type="date"> and pure-datepicker.js upgrades it automatically, site-wide.

Standard ID t-pure-datepicker · loaded by pure-shell.js. The native input is preserved (same value/change events) so existing forms keep working.

PURE writes like a trusted advisor: clear, brief, and respectful of the reader’s time. We explain; we do not hype. We say what a thing does, then its name. Canonical terms live in the PURE Dictionary and are enforced in copy. Folded in from brand/voice.html.

The “no clown stuff” rules, folded in from brand/donts.html. Canon: brand.no_clown_standard. The first of these is a ratcheted gate, not an opinion — emoji in product chrome fails the push and the count may only ever go down.

The test: would a private bank ship this screen? If it looks like a flashy startup or a clip-art deck, it is off brand.

A standards page that only describes things is a poster. Each row below names the surface that changes the rule, the row it is stored in, and the guard that catches it drifting — so “who do I ask to change this?” has an address instead of an answer.

One confirmation component, pure-toast.js, shipped on every page of both shells from the ui.globals switchboard. Nothing to import. PureToast.ok() is green with role="status"; .err() is red with role="alert", which a screen reader interrupts for; .warn() and .info() sit between them.

PureToast.auto(msg) reads the message and picks the kind — “Refused”, “could not” and “nothing was written” go red; “Saved”, “Sent” and “Added” go green. It is deliberately conservative: anything it cannot classify stays exactly where it was, so the worst case is the behaviour a page already had. Prefer .ok() and .err() where you know the outcome — the code should not have to read English to know whether it succeeded.

Felt feedback (pure-haptics.js)

Every announced outcome is also felt

Since 9/3/26 the toast carries its own felt half, site-wide and with no page edits: a success toast vibrates the success pattern on a phone and pulses green on a desktop; an alert toast vibrates the fail pattern and pulses red; a warn toast gives a single tap. The same feedback fires when a page cannot show its live data (PureLiveRequired.fail), when a gated form refuses to submit (pure-field-validate), and on a sign-in result. Reduced-motion users get the vibration and the toast, never the screen tint.

Rule for authors: do not call PureHaptics for an outcome a toast already announces — it would fire twice. Reach for PureHaptics.capture() / .celebrate() only for moments that have no toast (a photo captured, a deal closed). Configuration is one row: ui.haptics {on, flash, strength, patterns, colors}, controlled from the admin Security console.

Ten shared components, all shipped from the ui.globals switchboard on every page of both shells. Nothing to import and nothing to install: a page is covered by existing. Switching one off is a row in pure_ui_settings — one location, no deploy, and the page below reads that row so it shows what is actually on rather than what was intended.

Hand-rolls is the number that matters. The component already ships, so a hand-rolled copy is not a missing feature — it is a second answer to a settled question, and the second answer is almost always the worse one. Both is a page mid-migration: the cheapest tranche, because finishing it means deleting code rather than writing any.

Register: tools/component-standards.json · sweep: tools/component-standards.mjs · full list: component adoption. Adding the next component is a row in the register plus a globals row — not another tool, section and gate.

A standard nobody can link to is a standard nobody can cite. Inside a container marked data-deeplink — this page is one — every heading with an id carries a small ⟉ mark on the baseline: click it to copy that section’s absolute address. Since 9/3/26 the mark is opt-in, not everywhere (Mike: it had been overdone across both app shells and read as clutter). A page earns the mark only where a link-to-section genuinely helps — standards, runbooks, long reference pages — by marking that scope. Nothing else on the site shows one.

The mark is the whole control. It used to say COPY LINK as well, and the copy component then added its own ⟉ to the same element — so the affordance said the same thing twice and grew wide enough to compete with the heading it belonged to. One mark, in the position a reference mark belongs, is the standard. The name a screen reader announces lives in aria-label, which is the only accessible name it has now that there are no words — so it may never be blank.

Every section on this page also has its own document, which carries the same deep link — see The documents.

This page is twenty-eight sections long. Every heading now carries a hamburger: close the ones you are not reading and the page becomes the two or three rules you came for. Your choice is remembered for this surface.

Every standard on this page has its own markdown document, generated from the same row the section renders and never hand-edited — a hand-edited copy of a standard is a second standard, and the day it drifts nobody can tell which one is being enforced. Each carries the section’s deep link, the surface that changes the rule, the row it lives in and the guard on it.

Adding a standard to design.standards_index generates its document; removing one deletes it, and the push fails if a document is missing, drifted or orphaned. Those documents are a category of the library below, not a separate place.

Every document in PURE

The repo says what exists; this table says what we think of it. Bodies load from the live site, so what you read is what shipped — not a stored copy that drifted.

Manifest: docs/docs-manifest.json (published by tools/docs-manifest.mjs, and the push fails if a document exists that the library would never show) · review state: mcp_docs_review_state · saved by mcp_doc_review.

Working examples of the components that do not have a demo inside their own section. Everything here is the real component, loaded from the ui.globals switchboard on this page exactly as it is on every other — press the buttons. Adoption numbers for all of them are in Every component.

One company, two faces. Acquisto Real Estate is the consumer brokerage — how the public finds homes and meets the team. PURE is the platform — how professionals run the business. They are endorsed brands: distinct identities, visibly related, sharing one DNA strand (ARE Blue) and one body typeface. ARE is the storefront; PURE is the workshop behind it.

PURE has exactly one tooltip: pure-glossary.js, sourced live from pure_dictionary. Mark a term and the definition arrives from the row — edit the row and every tooltip in the product updates. A native title= is the operating system’s tooltip: unthemeable, delayed by a value PURE does not set, invisible on touch entirely, and carrying whatever sentence somebody typed that day instead of the definition the business agreed.

Three exemptions, each because the browser is doing something other than a tooltip: <svg><title> is a graphic’s accessible name (an element, not the attribute), <iframe title> is required by HTML and renders nothing, and <abbr> is the one element where the browser tooltip is the semantic — PURE does not use it for UI. Measured by tools/tooltip-audit.mjs, ratcheted in ci-gate: the count may only go down.

A native <select> never shrinks below its own label. The reason is not tidiness. A select in a flex row inherits flex-shrink:1, so the row squeezes it until the closed control is narrower than the text inside it — All modules renders as All mod. The browser then draws the option popup at the width of the closed control, so the list arrives as a narrow column with every option wrapped onto two lines.

Scope is deliberate: select:not([multiple]):not([size]). Multi-selects and list boxes are sized by their row count and are left alone, and custom dropdown components draw their own list inside the page, so the operating-system limitation does not apply to them.

A section header is one object with four parts, in one order: the collapse control, the kicker, the heading, and the link control. It spans the full width of the section and sits on a rule, so a long page reads as a stack of sections rather than a stream of text with buttons in it.

Shipped by pure-collapse.js (the control) and pure-deeplink.js (the link), assembled by the shared header rule in the shell stylesheet. The header on this very section is the reference implementation — if it looks wrong here, the standard is wrong, not the page.

A dashboard reports. A console changes something. If a surface only shows numbers it is a dashboard and belongs in Scorecards. The moment it writes to the table it displays, it is a console — and PURE has nine of them, previously built five different ways because there was no rule to build to.

A console is not a new component. It is an assembly of standards that already exist: the grid is Tables, the counts are Scorecards, the filters are Searchable pickers, the rows are addressable through Deep links, and the empty state is Wait states. What the standard adds is the assembly — and one rule none of those parts could enforce alone: a console must name the single table it indexes. A console over two tables is two consoles sharing a scrollbar.

Every console, and whether it is wired to anything

The one point that can be checked from inside the database: does the RPC each console claims to call actually exist. This is the check that would have caught pure-config-tables blaming authentication for a function that had never been built.

Standard: design.console_standard · registry: design.console_registry · read: mcp_console_standard(). Adding a console is a row in the registry — and the day its RPC is renamed, this table says so instead of the page saying “sign in”.

A spine is a table family + a function family + ONE cockpit that governs it. A spine without a cockpit is governed by whoever last edited a page. A cockpit without a spine is a page pretending to be a system.

The word means two different things here, and one of them was already stamped COMPLETE. This is the governance spine — pure_spines / pure_spine_pages. The data spine is mcp_pure_spine, one call that gives any surface the signed-in person, their desk, clearance, location and open work; that one was finished 7/31 and two status rows say so truthfully. Nobody had to notice this table was empty, because searching the word found a COMPLETE first. Name which spine before reporting either one done.

Every spine, counted live

Pieces are counted from the catalogue, not asserted: tables matching the family prefix plus functions matching it. The column that matters is pages assigned — a spine with rules and no pages governs nothing.

Standard: design.spine_standard · registry: pure_spines + pure_spine_pages · read: mcp_spine_standard() · guard: tools/spine-gate.mjs. Adding a spine is a row; assigning a page is a row. Neither is a deploy.

A standard describes what a component should do. This list decides whether it runs at all. pure-boot.js reads ui.globals on every page load, so turning a behavior on or off is a database write and not a deploy — and eleven of the standards on this page name “ui.globals” as the surface that controls them without ever offering a way to open it. This is that surface, and it lives here because a switch belongs beside the rule it switches.

The link between a script and its standard is derived, never typed: each src is matched against the controlled_by and stored_in columns of the standards index. Add a standard and its global links itself; rename one and it reads as unlinked rather than pointing confidently at the wrong rule.

One table: pure_ui_settings (org_id='*', settings->globals) · read mcp_globals_console() · write mcp_ui_settings_set('globals', …), admin-gated and audited. Off means gone site-wide on the next load — the emergency kill for the whole plane is window.PURE_BOOT_OFF=true.

Two modes, one list. They already existed and were named two different ways in the same panel — the buttons said act as while the footer said Viewing as. Named once here, with what each actually enforces.

Standard: design.actas_standard · sessions: pure_act_sessions · gate: mcp_act_start · selector: the account panel, four live lists from mcp_actas_options. Choosing a name grants nothing — the server decides.

One scale, both channels. Poppy has refused to read a closing figure to an unverified caller since the day the voice gate shipped — pure_voice_auth_policy classifies every action L1–L4 and holds it against the caller’s assurance level. An email carrying the same figure went out with no classification at all. The levels below are now the single scale for both, and L0 — the public tier everyone referred to and nobody had written down — is a row like the rest.

Standard: design.email_standard · scale: pure_pii_levels · read: mcp_email_standard() · library: pure_email_templates · console: Machine → Templates

A theme is a row, not a stylesheet. pure_themes holds one row per palette with 64 tokens each, and pure-theme.js injects them as CSS custom properties at runtime — so adding a palette, retiring one, or changing a single colour is a database write with no deploy. The changer people actually use is the account panel, under Appearance & theme; it reads the same rows.

Why some chips looked alike. Mike, 8/18: “some of them don’t render well.” They rendered exactly as told. Each chip drew three dots from navy, gold and gold-50 — and navy and gold are identical on eight of the thirteen themes, so two of the three dots matched and the only thing separating Desert from Spring from Winter was a third dot that is a near-white in all of them. Exact duplicates were zero, which is why nothing ever flagged it. The honest measure is NEAR duplicates, and the swatch now samples bg, ink and gold, which differ on every theme.

One table: pure_themes · read mcp_themes_console() · write mcp_theme_upsert · applied by pure-theme.js (ui.globals ord 15). A swatch must sample tokens that vary. The pair distances below are computed on every read, so a palette added tomorrow is measured the same way rather than trusted.

PURE shipped aria-label="" on every heading of every page for weeks, and a tool that fails on exactly that had been sitting in the repo the whole time. tools/a11y-audit.mjs loads pages in headless Chromium at 320/360/390 px and fails on the defect classes that keep biting: controls with no accessible name, touch targets under 24×24, body horizontal scroll on a phone, <th> without scope, and text inputs under 16 px (iOS zooms the page on focus). It was never wired into the gate. That is why the blank label survived.

Armed on the canon set, not on everything. Turning it on across 766 pages would fail every push on a backlog nobody has triaged, which teaches people to bypass the gate. It runs on this page and every console in the registry — twelve pages, three viewports, about nineteen seconds — and it is a ratchet: the count may only go down. A rule enforced on the surfaces that define the rules is a rule; the rest is a burn-down.

Baseline 46. That is what the canon set scores today, and it is stated rather than hidden. pure-tech-report.html scores 0 and is the shape to copy. The ratchet is proven in both directions: one nameless 10 px button took the count to 48 and failed the push; removing it passed.

Instrument: tools/a11y-audit.mjs · baseline: tools/ratchet-baseline.json (a11y_canon_findings) · the page set is the AUDIT list in the tool, which tracks the console registry.

A page edited for any reason adopts the current standards before it is pushed. Not a sweep — the page is already open. Sweeping 330 hand-rolling pages is a project nobody schedules and a risk nobody should take: six pages broke in one afternoon on 8/17 from exactly that. Converting the page you already have open costs nothing, and it is the only adoption mechanism here that has never stalled.

Standard: design.freshness_standard · cron: page-freshness, daily 11:20 am CT, calling mcp_page_freshness_tick(). Regressions are compared only within the same scoring scale — comparing a 6-point score to a 10-point one would report the scale change as a mass regression, which is a trap the nightly drafts already fell into once.

An overlay that will not close is not a cosmetic bug. It is a page the reader cannot leave. Both failures on 8/18 rendered perfectly and threw nothing anybody could see — which is why they need a rule and a guard rather than care.

Component: pure-close.js — one X, sized and coloured from brand tokens so the Brand Manager reskins every overlay at once. Canon: design.overlay_standard · guard: tools/dead-binding-gate.mjs, hard fail at zero.

Evidence for the claim you are making, at the altitude you are making it. On 18 August the Tech Report was reported healthy because mcp_tech_report() returned real rows in SQL. The next morning every section of it read HTTP 404: function public.[object Object]. The function was fine — the page could not call it. The evidence was real, and it supported a different claim than the one made.

Guard: tools/page-proof.mjs — every other gate here reads files; this one loads each page in a browser with every read stubbed empty and watches what it does. Baseline 21 across 8 canon pages, and it was checked by reintroducing the original defect. Full write-up: What counts as proof.

The one-line version. If the proof and the promise are on different rows of the ladder, you have not verified it — you have rehearsed it.

PURE runs on Central. A closing deadline shown in the reader's own zone with nothing saying so is not a smaller bug than a wrong date — it is the same bug, harder to notice. PureStamp has been canon since 6/12 and shipped on 31 of 780 pages while 243 rendered dates by hand; it is a ui.globals row as of 8/19, so every page has it and marked elements format themselves.

Component: pure-stamp.js · canon design.timestamp_standard · ratchet tools/adoption-ratchet.mjs (dates). Full write-up: One standard, four classes.

pure_memory holds 907 pieces of hard-won knowledge — 277 lessons, 144 bugs, 417 canon rows, 69 routines. Read back, they are not 907 separate mistakes. They are seven shapes, over and over.

The column that matters is the last one. A shape with a detector cannot recur silently. A shape without one relies on somebody remembering — and this week proved that does not happen: a second time-zone system was built on 8/19 without anyone finding the first, while lesson.search_before_building had been sitting in this database since 8/16. The lesson existed. Nothing made anyone read it.

Registry: pure_failure_shapes · read mcp_failure_shapes() · canon design.failure_shapes. Adding a shape is a row; adding its detector is what closes it.

PURE has had a real QR standard for months — eleven functions, a self-healing host guard and a lockstep checker — and not one line of it was written down. A standard nobody can point at gets reinvented by the next person who needs a QR code, which is how the estate ends up with four of them.

Make one

The generator that used to live at /pure-qr, folded in here so the tool and the rule are the same page. It runs the shipped component — pure-qr.js, the same one every sign, rider and postcard uses — so what you download here is what prints there.

Mint or resolve: mcp_email_qr_url(target, deal, kind, size) · render: pure_email_qr_block_labeled() · place in an email: pure_email_qr_inject() · heal the host: mcp_qr_host_guard(dry_run) · prove QR and link agree: mcp_email_qr_lockstep(). Sign-in QRs are mcp_qr_login_start/_status/_approve/_deny — single-use, short-lived, approved on a second device.

Four emails from noreply@acquisto.biz arrived on one morning with four different chromes: a bare <div> from the connector watchdog, an older navy header on License Watch and the digest, and a third look on the Daily Brief. In the seven days after the email standard shipped, zero of 161 outbound emails used it.

Applied by trg_comms_wrap on pure_comms_log — on the table, because 161 sends came from fourteen principals and a rule written at the callers is wrong the first time somebody adds the fifteenth. Themes: the email standard · pure_email_themes.

PURE is a Central-time company in McKinney, Texas. America/Chicago is the record and the default: it is what a stamp means when nothing else is said. A person can differ from it — by choosing a zone, or by travelling — and the difference is always visible rather than guessed from whichever laptop they opened.

Your setting

Three modes, and travel is the interesting one: it follows your device while you are away and ends by itself the moment your device says you are home again. It never overwrites your home zone, because forgetting to switch back is the normal case.

Read: mcp_tz_resolve() · write: mcp_tz_set() · stored on pure_user_prefs · canon design.timezone_standard · rendered by pure-stamp.js, which also measures the server clock so a device with the wrong time cannot stamp a filing with a time that never happened.

An icon-only button with no text and no aria-label is announced as “button” and nothing else. The reader is told there is a control and not what it is for — the same defect as a table header with no scope, in a different place.

Component: pure-a11y.js · canon design.accessible_names · ratchet tools/adoption-ratchet.mjs (unnamed) · also gated by tools/a11y-audit.mjs on the canon set.

A page wears chrome it did not choose for itself. Until 9/1, 43 pages hardcoded a <script src="/pure-appshell.js"> tag — which always wins, because pure-shell.js correctly no-ops when a shell is already mounted. Their pure_pages.shell row was inert decoration. Three of them were public or client_token with shell='none' in the row, and mounted the internal staff app shell anyway.

Registry: pure_pages.shell (read mcp_page_shell, one line per page: <script src="/pure-shell.js" defer></script>) · guard mcp_nav_shell_audit() — shell_unset, boneyard_outside_admin and header_echo must stay empty · canon design.chrome.

Postgres grants EXECUTE to PUBLIC by default on every new function, and information_schema reports the effective privilege — so a grant inherited through PUBLIC reads exactly like a direct grant to anon. On 8/31 a revoke of an anon mass-texting endpoint ran clean and changed nothing for exactly this reason. Only pg_proc.proacl shows the difference: a leading =X entry is the PUBLIC grant.

Source of truth: pg_proc.proacl, never information_schema · guard: mcp_upgrade_register() derived row D-public, target 0, not closable by hand · canon design.grants.

A surface either shows live rows or says out loud that it cannot. It never shows a stored copy that looks like data. The storefront served a 46-item seed while the live catalog held 71; upgrades.html declared its fallback honestly on screen and still served it to every visitor, because the RPC it named did not exist. A failed read must never wear the data’s clothes.

Registry: pure_data_surfaces.fallback_rows · pure_live_outages · guards mcp_fallback_drift_tick, mcp_live_outage_tick and mcp_upgrade_register() derived row D-fallback, target 0 · canon design.livedata.

On 9/2 five review cards carried “auto-processed by Autopilot”; two had no work behind them for eight weeks, and one named a function that did not exist. The phrase recorded a decision. Nothing recorded work. So the rule moved from the writer to the table: when an Autopilot-dispatched card’s status moves to done, the database runs the card’s done_check at that moment and refuses the transition if it fails or is absent. A person may still close it — and the card says who did, and that the check had not passed.

Guard: trg_board_done_check, BEFORE UPDATE on pure_board — it refuses, it does not report · evaluator pure_done_check_run(jsonb), four kinds (fn, row, count, human), identifiers through %I, values bound · canon design.done_check.

A noun a person can read but not follow is a dead noun. Each entity kind — deal, listing, person, organisation, vendor, ticket, document, meeting, report — has exactly one home route, held in pure_link_homes, and the entity’s name on any page is the anchor to it, carrying the key and never the label. Briefed by Design 9/2; written to canon by Code the same day.

Registry: pure_link_homes (entity kind → home route) · guard mcp_link_homes_check() — every home is an enabled page and every kind has one home · doc linking.md

A page family carries one Pure BI strip. Which reports fill it, in what order and for which hats is a row in pure_bi_placements edited in the BI admin; the page declares only a slot and pure-bi-embed.js draws it from a live bi_reports() read with the states kit. The Tech Control Panel showed “76 tables” for two months because its band was markup; live was 1,054.

Registry: pure_bi_placements · pure_bi_reports · read bi_placements(p_surface, p_hat) · guard mcp_bi_band_coverage() — page families with no placement · doc bi-band.md

A number, a date, money, a status, a person, an address, a table, a count: each has one named component and a page uses it or is wrong. Time is PureStamp, fields are PureFormat by pure_field_formats, a status is a dictionary pill, a person is a linked name behind the PII gate, rows are PureTable, a count is a stat tile that drills. Component names, not prose.

Registry: pure_components · pure_field_formats · pure_dictionary · guards: the adoption ratchet (dates, clipboard, tooltips), the th-scope gate, component-standards REGROWTH · doc datashape.md

Names, counts, BI tiles, list rows, vocabulary pills and every action the page names in prose are interactive. Headings, labels, notes and values the viewer’s hat cannot change never are. A link looks like a link, a button is the buttons component, every control has an accessible name, every live page is reachable from navigation, and every action a button performs is also a Poppy skill so a person may click or ask.

Registry: pure_nav_modules · pure_pages.nav_disposition · guards: tools/dead-binding-gate.mjs, the accessible-name ratchet, tools/nav-route-gate.mjs, tools/redirected-asset-gate.mjs · doc navigable.md

Three floods hit the board in one week — 155,000 bug reports from one form, 1,750 upload notices, 654 stale snapshots of recurring checks — and all were the same missing idea: the writer minted a card per run. A condition writer keeps one card per condition, keyed by what and where, updated in place and closed by the run that finds the condition gone. An event writer keeps one card per event with a signature, a window and a ceiling. Every writer says which it is.

Writer: pure_condition_card(id, active, title, notes, lane) · event pattern: pure_error_reports.signature · guard mcp_board_writer_lint() (condition writers whose id carries run time or randomness; card BOARD-WRITERS-RUNTIME-ID) · doc condition-card.md

Deleting 154,733 rows without fixing the form would have been a cleanup done twice. The order is fixed: readers repointed, writer guarded, rows snapshotted, then the clear — with the operator’s go-ahead recorded. Noise is archived, never marked done; the pile is counted from the table, never from the brief that reported it.

Registry: dated snapshot tables (RLS on) and undo.* rows · guards: the never-delete hook, mcp_board_writer_lint, lesson.backup_tables_need_rls · doc writer-first.md

On 9/2/26 the primary nav held 76 routed pages. Twenty-seven of them reached the database for nothing — invented KPI tiles and fictional rows on pages a person opens from the menu — and thirty-eight more read live without a failure state, so a broken read could wear the data’s clothes. Seven were converted the same night; this standard makes both numbers ratchets that only fall.

Registry: tools/nav-primary-routes.json (snapshot of pure_nav_tree primary, refreshed by tools/nav-routes-refresh.mjs) · guard: tools/shell-live-gate.mjs in gate:all, ratchet tools/shell-live-baseline.json (the reader self-tests every known spelling of a read on each run and fails loudly if it loses one) · renderer pure-page-live.js · playbook playbook.make_page_dynamic · doc shell-live.md

Until 8/19 PURE had six answers to “is this page public?” — four hand-copied arrays in JavaScript, one regex, and a column that meant something else. Thirty-four paths between them and ten agreed. The disagreements were live: a signed-out visitor asking for the privacy policy, the terms, Do Not Sell, the accessibility statement, the SMS policy or a one-tap email link was redirected to sign-in.

Registry: pure_pages.protection (read mcp_public_paths, write mcp_page_protection_set) · exemption view pure_public_exemptions · canon design.page_protection · standard PUBLIC-EXEMPTION-REGISTRY.

Two surfaces that both write a subject drift, and the drift stays invisible until somebody compares them. Two surfaces where one writes and the other reads and links back cannot drift at all. That is the whole pattern.

Worked example — the menu tree

pure_nav_tree has exactly one writer: Navigation Management. Two surfaces that show placement now read it and link back, deep-linked to the row rather than the top of the page — because a link that lands somebody at the top of a 311-page list is the same as no link.

The link belongs in the page, not the menu. A menu entry is for going somewhere. This is for the moment the reader is already looking at the fact and wants to change it. Canon: design.source_of_truth_standard · the owner of each subject is a row in design.console_registry, rendered at Consoles.

Seven steps, in order. Nothing is deleted before the thing replacing it is real and complete. The run this process from is Navigation Management → Combine, which saves the plan first and parks separately — boneyarding a page before its features live elsewhere loses working features.

Why two stores, and why not one

The question that produced this section: “I don’t know why we would have different stores in the same app shell — probably something we should reconcile into one.” Right instinct, and the cardinality is the answer.

The guard, right now

Step 7 is not advice — it is a read. Any live menu row pointing at a parked or disabled target appears here and is filed as a Poppy-owned ticket by the nav-retired-guard cron.

Standard: design.retirement_standard · stores: design.pages_vs_nav · read: mcp_retirement_standard() · guard: mcp_nav_retired_audit(), cron nav-retired-guard 11:40 am CT.

A gate runs when somebody pushes. A cron runs when nobody does. Every standard on this page needs both: the gate stops a change that breaks the rule, the cron notices when the rule quietly stopped being true. This table is the join — read live, so a cron that is renamed, disabled or deleted shows up as missing here on the next load instead of lingering as a green claim.

Poppy runs all of it; a human is the backup, not the operator. Every row this files opens as a Poppy-owned ticket in the one ticket system with no approval in the path. A human is asked only when Poppy has worked a section twice and it is still not covered — a failed work pass, never merely an old ticket. So Runner is a measurement, and driving that column to all-Poppy is what “remove the human” means in practice.

What each standard is measured by

Counts are facts about the repository and are published from it (docs/standards-metrics.json); health and cadence are facts about the database and are read live. Neither pretends to own the other. A bar is the backlog in the files — not what a visitor experiences, because each of these standards also applies itself at runtime.

The registry

Map: design.standards_orchestration · read: mcp_standards_orchestration() · the one cron: standards-orchestrate, daily 10:35 am CT, calling mcp_standards_orchestrate_tick(). Adding a cron to a standard is a row in the map, not a deploy — and the moment it is added, this table and that standard’s document both change.

The rule was canon before this page said it. design.appshell_two_shells_final has been the decision since 7/13/26 and every shell argument since has been settled against it — but it was never written down here, so the standard the Site Control rows are judged by lived only in the database. Rendered live below rather than retyped, because a copy is the thing that goes stale.

Where the rows are: Site Control → App shells lists every page with what its file does, what the registry says, a verdict and a one-click adopt. This section is the rule; that tab is the decision.

The problem this solves: a pasted brief is a snapshot, and snapshots lie. Project instructions typed once go stale the first time a count moves, and nobody notices because the paste still reads confidently. So the brief here is generated — mcp_project_brief() reads the registry, the spines, the scheduler and the canon keys at call time. The short block below is the only thing anyone pastes anywhere, and its first instruction is to go read the live one.

Paste this into the project’s Instructions

Short on purpose. Everything it does not say, the live brief says — and it tells the reader that the live brief outranks it.

What to attach as project context

The regular cadence

What a collaborator is asked to do on a repeating basis, and what they are asked never to do. This is the same list that ships in the handover file.