feat(design): the panel now asks whether the app agrees with its own sheet

Retiring rulebook #2 left the /design drift panel with no data source, and
because its empty state was well-written the feature read as working while it
could only ever render "nothing designated" (#2419). The original question is
genuinely gone: theme.css is generated from design system 2, so checking the
system against a sheet derived from it would be a tautology.

The question that survives is the one no server can answer. A generated sheet
still has to be LOADED and APPLIED, and nothing checked that it was:

  absent      the record declares a token the app doesn't have — the sheet was
              never regenerated after the record changed, or never loaded
  differs     the app has it with another value — a stale sheet, or a later
              rule that overrode it
  unrecorded  the app declares a token in the record's own family that the
              record has never heard of

Both sides go through the same engine so the comparison is honest: declared
values are set on an offscreen probe and read back, which performs the same
var() substitution the browser already did to the live values. Comparing raw
strings would mark every derived token as drift.

The designation moved with the feature — design_rulebook_id becomes
ui_design_system_id, with a migration deleting the retired key rather than
leaving an inert row. The prose extractor it fed goes too (#2288 said its
runtime role ended when the import landed).

Three orphans of the same shape, found alongside and fixed here:

- darkOverriddenNames hardcoded [data-theme="dark"]. The sheet went dark-first
  months ago, so it matched nothing and the "mode-aware" flag silently left the
  gallery. Now matches the SHAPE of a mode selector, which also holds for an
  install whose modes aren't light and dark.
- groupFor's prefix table never heard of --fs-, so 110 tokens sat under
  "other". Groups now come from the record where there is one; the table can
  only know families that shipped with the product (rule #115).
- The type scale was a hand-written table of nine sizes marked "no token",
  true when written and false since the scale was recorded. Now rendered from
  whatever size tokens the sheet declares, so it can't go stale twice.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UaYUaouG9jjhATyuxCKrQs

frontend/src/utils/designDrift.ts

@@ -1,58 +1,80 @@
 /**
- * Drift comparison — what the rulebook claims vs what the stylesheet does.
+ * Agreement — does the running app match the design system it was built from?
  *
- * Milestone #251 step 5. Deliberately thin: the hard half (turning rulebook
- * prose into claims) is server-side in `services/design_system.py`, where pytest
- * can assert on it. What's left here is set arithmetic over live token values,
- * which is the one thing the browser knows and the server doesn't.
+ * This panel used to compare a design RULEBOOK's prose claims against the live
+ * tokens. That rulebook was retired into the design system on 2026-08-01, and
+ * the feature spent two days rendering a reassuring empty state instead of
+ * failing (#2419). Its replacement is not the same question re-aimed: comparing
+ * a design system against a stylesheet generated from that same design system
+ * would be a tautology.
+ *
+ * The question that survives is the one no server can answer. A sheet still has
+ * to be LOADED and APPLIED, and until now nothing checked that it was. Three
+ * failures live in that gap:
+ *
+ *   absent   the app has no such token at all — the sheet was never
+ *            regenerated after the record changed, or never loaded
+ *   differs  the app has the token with another value — a stale copy of the
+ *            sheet, or a later rule that overrode it
+ *   unrecorded  the app declares a token in the record's own family that the
+ *            record has never heard of — hand-editing that outlived its reason
  *
  * SCOPE, and it is a real limit rather than an omission. This compares the
- * rulebook against the TOKENS. It cannot see the third category of drift — a
- * literal hardcoded in a component where a token should be referenced (#2275,
- * 67 occurrences of `color: #fff` against a rule that forbids pure white). That
- * drift isn't in the tokens at all, so no amount of inspecting them finds it.
- *
- * Catching it needs the component sources, which would mean bundling every SFC
- * into the app to read at runtime — a large cost for a panel. It belongs in CI,
- * as a lint-shaped check, and is tracked there (#2277). Saying so in the panel
- * matters: a drift report that silently omits a category invites the reader to
- * conclude the category is clean.
+ * record against the TOKENS. A literal hardcoded in a component where a token
+ * should be referenced is invisible here, because the drift isn't in the tokens
+ * at all — that check has the component sources and belongs in CI (#2277).
+ * Saying so in the panel matters: a report that silently omits a category
+ * invites the reader to conclude the category is clean.
  */
 import type { DesignToken } from "@/utils/designTokens";
 
-export type ExpectationKind = "token" | "color" | "prohibited_color";
+/** The base mode's key in a token's `value_by_mode`, mirroring services/design_stylesheet. */
+export const BASE_MODE = "base";
 
-export interface Expectation {
-  kind: ExpectationKind;
+/** One token as the RECORD has it, already narrowed to the mode being checked. */
+export interface RecordedToken {
+  name: string;
+  /** Declared value for this mode, or "" when the role is named but unvalued. */
   value: string;
-  rule_id: number;
-  rule_title: string;
-  context: string;
+  groupName: string | null;
 }
 
-export interface ExpectationResponse {
-  rulebook_id: number | null;
-  expectations: Expectation[];
-}
+export type AgreementStatus = "ok" | "absent" | "differs" | "unrecorded";
 
-export type FindingStatus = "ok" | "missing" | "violated";
-
-export interface Finding {
-  expectation: Expectation;
-  status: FindingStatus;
-  /** Tokens that satisfy (or, for a prohibition, breach) the expectation. */
-  matches: string[];
+export interface Agreement {
+  name: string;
+  groupName: string | null;
+  /** What the record declares, resolved. Empty for an `unrecorded` row. */
+  recorded: string;
+  /** What the browser resolved. Empty for an `absent` row. */
+  live: string;
+  status: AgreementStatus;
 }
 
 /**
- * Normalise a colour for comparison — the client-side twin of
- * `normalize_hex` in services/design_system.py.
+ * Which declared value applies when the page is in `mode`.
  *
- * These two MUST agree. The rulebook writes `#FFFFFF`, `theme.css` writes
- * `#fff`, and getComputedStyle hands back `rgb(255, 255, 255)` — three
- * spellings of one colour, and a comparison that misses any of them under-reports
- * rather than erroring. The rgb() case is browser-specific and therefore has no
- * server-side counterpart, which is exactly why it is handled here.
+ * Falls back to base, which is the storage model rather than a convenience: a
+ * mode block is an OVERRIDE layer, so a token with no entry for the current
+ * mode is not missing — it is inheriting, exactly as the sheet has it.
+ */
+export function valueForMode(
+  valueByMode: Record<string, string>,
+  mode: string,
+): string {
+  const own = valueByMode[mode];
+  if (own !== undefined && own !== "") return own;
+  return valueByMode[BASE_MODE] ?? "";
+}
+
+/**
+ * Normalise a colour for comparison.
+ *
+ * A record writes `#FFFFFF`, a sheet writes `#fff`, and
+ * getComputedStyle can hand back `rgb(255, 255, 255)` — three spellings of one
+ * colour, and a comparison that misses any of them over-reports drift, which is
+ * the failure that gets a panel ignored. The rgb() case is browser-specific and
+ * therefore has no server-side counterpart, which is exactly why it is here.
  */
 export function normalizeColour(value: string): string | null {
   const raw = value.trim().toLowerCase();
@@ -66,7 +88,9 @@ export function normalizeColour(value: string): string | null {
     return digits.length === 6 || digits.length === 8 ? `#${digits}` : null;
   }
 
-  // getComputedStyle always reports colours as rgb()/rgba(), never as authored.
+  // getComputedStyle reports real colour properties as rgb()/rgba(), never as
+  // authored. Custom properties are token streams and usually come back as
+  // written, so this arm is insurance rather than the common path.
   const rgb = /^rgba?\(([^)]+)\)$/.exec(raw);
   if (rgb) {
     const parts = rgb[1].split(/[,\s/]+/).filter(Boolean);
@@ -84,86 +108,128 @@ export function normalizeColour(value: string): string | null {
   return null;
 }
 
-/** Every distinct colour the stylesheet actually resolves to, mapped to its tokens. */
-export function colourIndex(tokens: DesignToken[]): Map<string, string[]> {
-  const index = new Map<string, string[]>();
-  for (const token of tokens) {
-    const colour = normalizeColour(token.value);
-    if (!colour) continue;
-    const names = index.get(colour);
-    if (names) names.push(token.name);
-    else index.set(colour, [token.name]);
-  }
-  return index;
+/**
+ * Compare two CSS values for sameness, not for identical text.
+ *
+ * Whitespace inside a compound value is not meaningful — `0 2px 10px` and
+ * `0  2px  10px` are one shadow — and neither is case, since a custom property
+ * carries no font names or content strings that would be changed by folding it.
+ * Colours go through the normaliser first so spelling differences don't read as
+ * drift.
+ */
+export function sameValue(a: string, b: string): boolean {
+  const canon = (v: string) => {
+    const trimmed = v.trim();
+    return normalizeColour(trimmed) ?? trimmed.replace(/\s+/g, " ").toLowerCase();
+  };
+  return canon(a) === canon(b);
 }
 
 /**
- * Compare claims against the live tokens.
+ * The families the record claims, as name prefixes.
  *
- * A `token` claim asks whether a custom property of that name exists.
- * A `color` claim asks whether any token resolves to that value.
- * A `prohibited_color` claim INVERTS the test — present is the failure.
+ * Used to decide which live tokens count as `unrecorded`. An app's stylesheet
+ * legitimately carries names the record never owned — Scribe's own sheet keeps
+ * a `--color-*` alias layer over the design system's `--fs-*` block — and
+ * reporting those as drift would bury the real findings under a compatibility
+ * shim. So the record is treated as owning a FAMILY, identified by the prefix
+ * up to the first separator, and nothing outside it is judged.
+ *
+ * Derived from the data rather than configured, because the prefix is the
+ * install's choice (see design_starter_roles) and hardcoding one would put a
+ * single operator's naming into every install (rule #115).
  */
-export function compareToTokens(
-  expectations: Expectation[],
-  tokens: DesignToken[],
-): Finding[] {
-  const names = new Set(tokens.map((t) => t.name));
-  const colours = colourIndex(tokens);
-
-  return expectations.map((expectation) => {
-    if (expectation.kind === "token") {
-      const present = names.has(expectation.value);
-      return {
-        expectation,
-        status: present ? "ok" : "missing",
-        matches: present ? [expectation.value] : [],
-      };
-    }
-
-    const matches = colours.get(expectation.value) ?? [];
-    if (expectation.kind === "prohibited_color") {
-      return {
-        expectation,
-        status: matches.length ? "violated" : "ok",
-        matches,
-      };
-    }
-    return {
-      expectation,
-      status: matches.length ? "ok" : "missing",
-      matches,
-    };
-  });
+export function recordedFamilies(names: Iterable<string>): string[] {
+  const families = new Set<string>();
+  for (const name of names) {
+    const match = /^(--[A-Za-z0-9]+-)/.exec(name);
+    if (match) families.add(match[1]);
+  }
+  return [...families];
 }
 
-export interface DriftSummary {
+/**
+ * Compare the record against the running app.
+ *
+ * `resolved` is the record's declared values after the browser has substituted
+ * `var()` in them (see `resolveDeclared`) — the same treatment the live values
+ * already received, which is what makes the two comparable.
+ *
+ * Tokens the record names but has no value for are SKIPPED, not reported. A
+ * valueless token is a role awaiting a decision, and the stylesheet already
+ * reports those under `valueless`; counting them as drift would mean a system
+ * created with starter roles opens this panel red on day one.
+ */
+export function compareToApp(
+  recorded: RecordedToken[],
+  resolved: Map<string, string>,
+  live: DesignToken[],
+): Agreement[] {
+  const liveByName = new Map<string, string>();
+  for (const token of live) liveByName.set(token.name, token.value);
+  const out: Agreement[] = [];
+
+  for (const token of recorded) {
+    if (!token.value) continue;
+    const declared = resolved.get(token.name) ?? token.value;
+    const actual = liveByName.get(token.name) ?? "";
+    out.push({
+      name: token.name,
+      groupName: token.groupName,
+      recorded: declared,
+      live: actual,
+      status: !actual ? "absent" : sameValue(declared, actual) ? "ok" : "differs",
+    });
+  }
+
+  const known = new Set(recorded.map((t) => t.name));
+  const families = recordedFamilies(known);
+  for (const token of live) {
+    if (known.has(token.name)) continue;
+    if (!families.some((prefix) => token.name.startsWith(prefix))) continue;
+    out.push({
+      name: token.name,
+      groupName: null,
+      recorded: "",
+      live: token.value,
+      status: "unrecorded",
+    });
+  }
+
+  return out;
+}
+
+export interface AgreementSummary {
   ok: number;
-  missing: number;
-  violated: number;
+  absent: number;
+  differs: number;
+  unrecorded: number;
   total: number;
 }
 
-export function summarise(findings: Finding[]): DriftSummary {
-  const summary: DriftSummary = { ok: 0, missing: 0, violated: 0, total: findings.length };
-  for (const finding of findings) summary[finding.status] += 1;
+export function summarise(agreements: Agreement[]): AgreementSummary {
+  const summary: AgreementSummary = {
+    ok: 0, absent: 0, differs: 0, unrecorded: 0, total: agreements.length,
+  };
+  for (const a of agreements) summary[a.status] += 1;
   return summary;
 }
 
 /**
  * Findings worth leading with.
  *
- * A panel that opens with every row gets closed and never reopened — the same
- * principle the auto-inject menu is built on: a short list that gets read beats
- * a complete one that doesn't. Violations first (something is actively wrong),
- * then missing (something was never built), and `ok` rows are not "findings" at
- * all — they belong behind an expansion.
+ * A panel that opens with every row gets closed and never reopened. `absent`
+ * leads because it is the one status that can mean the whole sheet is missing;
+ * `differs` next, because a wrong value is being rendered right now;
+ * `unrecorded` last, since it is a bookkeeping gap rather than a visible fault.
+ * `ok` rows are not findings at all and belong behind an expansion.
  */
-export function rankFindings(findings: Finding[]): Finding[] {
-  const order: Record<FindingStatus, number> = { violated: 0, missing: 1, ok: 2 };
-  return [...findings].sort((a, b) => {
+export function rankAgreements(agreements: Agreement[]): Agreement[] {
+  const order: Record<AgreementStatus, number> = {
+    absent: 0, differs: 1, unrecorded: 2, ok: 3,
+  };
+  return [...agreements].sort((a, b) => {
     const byStatus = order[a.status] - order[b.status];
-    if (byStatus !== 0) return byStatus;
-    return a.expectation.rule_id - b.expectation.rule_id;
+    return byStatus !== 0 ? byStatus : a.name.localeCompare(b.name);
   });
 }

frontend/src/utils/designTokens.ts

@@ -2,7 +2,8 @@
  * Design-token inventory — what tokens exist, and what they actually resolve to.
  *
  * Foundation for the design explorer (milestone #251): the gallery renders
- * against these, and the drift panel compares them to the design rulebook.
+ * against these, and the agreement panel compares them to the design system the
+ * install says its UI is built from (#2419).
  *
  * DESIGN NOTE — why this parses NAMES but never VALUES.
  * Extracting `--foo` from a stylesheet is a trivial, robust regex. Extracting
@@ -42,8 +43,8 @@ export interface DesignToken {
   group: TokenGroup;
   /** Resolved value in the requested context, straight from the browser. */
   value: string;
-  /** True when the declaration appears inside the dark block in source. */
-  overriddenInDark: boolean;
+  /** True when the token is re-declared under a mode selector in source. */
+  modeAware: boolean;
 }
 
 /**
@@ -61,8 +62,21 @@ const DECLARATION = /(--[A-Za-z0-9_-]+)\s*:/g;
 /** Comments are stripped first so a commented-out declaration isn't counted. */
 const COMMENT = /\/\*[\s\S]*?\*\//g;
 
-/** The dark block's selector, as written in theme.css. */
-const DARK_SELECTOR = '[data-theme="dark"]';
+/**
+ * Any mode-override block, whichever mode it names.
+ *
+ * This used to hardcode `[data-theme="dark"]`, and that stopped being true the
+ * day the sheet went dark-first: `:root` now carries dark and
+ * `[data-theme="light"]` overrides it. The hardcoded selector matched nothing,
+ * `overriddenInDark` was false for all 186 tokens, and the "mode-aware" flag
+ * silently vanished from the gallery — a UI that kept rendering, wrongly.
+ *
+ * Matching the SHAPE rather than one mode name is what makes that unrepeatable,
+ * and it is also the only version that holds for an install whose modes aren't
+ * light and dark (rule #115). `selector_for_mode` in services/design_stylesheet
+ * emits exactly this shape, so the two ends agree by construction.
+ */
+const MODE_SELECTOR = /\[data-theme=["']?[\w-]+["']?\]/g;
 
 const GROUP_PREFIXES: ReadonlyArray<[string, TokenGroup]> = [
   ["--color-", "color"],
@@ -96,15 +110,21 @@ export function tokenNames(css: string = themeCss): string[] {
   return out;
 }
 
-/** The subset re-declared inside the dark block — i.e. tokens that change with mode. */
-export function darkOverriddenNames(css: string = themeCss): Set<string> {
+/** The subset re-declared under a mode selector — i.e. tokens that change with mode. */
+export function modeOverriddenNames(css: string = themeCss): Set<string> {
   const bare = css.replace(COMMENT, "");
-  const start = bare.indexOf(DARK_SELECTOR);
-  if (start === -1) return new Set();
-  const open = bare.indexOf("{", start);
-  const close = bare.indexOf("}", open);
-  if (open === -1 || close === -1) return new Set();
-  return new Set(tokenNames(bare.slice(open, close)));
+  const names = new Set<string>();
+  for (const match of bare.matchAll(MODE_SELECTOR)) {
+    if (match.index === undefined) continue;
+    const open = bare.indexOf("{", match.index + match[0].length);
+    if (open === -1) continue;
+    // A custom-property block is flat, so the first `}` closes it. Anything
+    // nested would be a rule, not a declaration, and has no tokens to find.
+    const close = bare.indexOf("}", open);
+    if (close === -1) continue;
+    for (const name of tokenNames(bare.slice(open, close))) names.add(name);
+  }
+  return names;
 }
 
 /**
@@ -116,15 +136,46 @@ export function darkOverriddenNames(css: string = themeCss): Set<string> {
  */
 export function readTokens(host: Element = document.documentElement): DesignToken[] {
   const computed = getComputedStyle(host);
-  const dark = darkOverriddenNames();
+  const modal = modeOverriddenNames();
   return tokenNames().map((name) => ({
     name,
     group: groupFor(name),
     value: computed.getPropertyValue(name).trim(),
-    overriddenInDark: dark.has(name),
+    modeAware: modal.has(name),
   }));
 }
 
+/**
+ * Read a set of DECLARED values as the browser would resolve them.
+ *
+ * The point is to compare like with like. A design system records
+ * `color-mix(in srgb, var(--fs-accent) 15%, transparent)`; the browser reports
+ * the same token with `var()` already substituted. Comparing those two strings
+ * marks every derived token as drift, which is a report nobody can read.
+ *
+ * So both sides go through the same engine: set the declarations on an
+ * offscreen probe, read them back, and the substitution is done by the
+ * implementation that will do it for real rather than by a parser of ours.
+ * Undeclared references fall through to the page's own values, which is what
+ * the cascade would do anyway.
+ */
+export function resolveDeclared(declared: Map<string, string>): Map<string, string> {
+  const probe = document.createElement("div");
+  probe.style.display = "none";
+  for (const [name, value] of declared) probe.style.setProperty(name, value);
+  document.body.appendChild(probe);
+  try {
+    const computed = getComputedStyle(probe);
+    const out = new Map<string, string>();
+    for (const name of declared.keys()) {
+      out.set(name, computed.getPropertyValue(name).trim());
+    }
+    return out;
+  } finally {
+    probe.remove();
+  }
+}
+
 /**
  * Read tokens as they would resolve in a given mode, without touching the page.
  *
@@ -132,16 +183,15 @@ export function readTokens(host: Element = document.documentElement): DesignToke
  * mutated to take a reading.
  *
  * KNOWN LIMITATION, and it is a property of the stylesheet rather than of this
- * function: light is declared on `:root` while dark is declared on
- * `[data-theme="dark"]`. An attribute selector can ADD the dark values to a
- * subtree, but there is no `[data-theme="light"]` block to add the light ones
- * back. So reading "light" from inside a dark page returns the dark values —
- * the probe has nothing to match.
+ * function: mode scoping is one-way. Whichever mode the sheet treats as its
+ * BASE lives on `:root` and has no attribute selector of its own, so a probe
+ * can add an overriding mode to a subtree but can never add the base mode back.
  *
- * Concretely: dark-inside-light previews work, light-inside-dark previews do
- * not. Introducing a `[data-theme="light"]` block alongside the dark-first flip
- * (milestone #251 step 6) is what makes this symmetric, and until then callers
- * should treat a cross-mode read as best-effort.
+ * The sheet is dark-first today — `:root` carries dark, `[data-theme="light"]`
+ * overrides it — so light-inside-dark previews work and dark-inside-light ones
+ * return the light values. That direction flipped when the sheet did, which is
+ * why this says "the base mode" rather than naming one: callers should treat a
+ * cross-mode read as best-effort either way.
  */
 export function readTokensForMode(mode: ThemeMode): DesignToken[] {
   const probe = document.createElement("div");
@@ -155,13 +205,25 @@ export function readTokensForMode(mode: ThemeMode): DesignToken[] {
   }
 }
 
-/** Tokens grouped by family, preserving source order within each group. */
-export function groupTokens(tokens: DesignToken[]): Map<TokenGroup, DesignToken[]> {
-  const out = new Map<TokenGroup, DesignToken[]>();
+/**
+ * Tokens grouped by family, preserving source order within each group.
+ *
+ * `overrides` maps a token name to the group it should sit under, and exists
+ * because the prefix table above can only know the families that shipped with
+ * the product. An install's own design system knows the groups it authored, so
+ * a caller holding the record passes them here rather than the taxonomy growing
+ * one operator's prefixes (rule #115).
+ */
+export function groupTokens(
+  tokens: DesignToken[],
+  overrides: Map<string, string> = new Map(),
+): Map<string, DesignToken[]> {
+  const out = new Map<string, DesignToken[]>();
   for (const token of tokens) {
-    const bucket = out.get(token.group);
+    const group = overrides.get(token.name) ?? token.group;
+    const bucket = out.get(group);
     if (bucket) bucket.push(token);
-    else out.set(token.group, [token]);
+    else out.set(group, [token]);
   }
   return out;
 }