Locked decisions, newest first. A rule lands here when a verdict is given, and entries are never edited after the fact: a changed mind is a new entry that supersedes the old one. This page is rendered from the canonical record, decisions/log.md in the repo; the record governs.

2026-10-17 · accepted (design lead direction, same session)

Each device chapter declares a fidelity ladder (full, reduced, flat). Surfaces degrade down their chapter’s ladder without changing layout, role mapping, state grammar, or voice. Partial implementation (the web chapter) is doctrine with its unreachable rungs named. Fidgets are compositor transforms over token-driven geometry: designed at full, declared at reduced, honestly absent at flat. why: demanding the richest platform’s tricks everywhere ships the poorest version everywhere else. The ladder makes “amazing on every platform” a property of the grammar instead of the renderer.

2026-10-17 · accepted (design lead direction, same session)

Theme lane and variant, material strength (translucency), motion comfort, and the density backup are suite-level appearance settings every surface inherits. Per-app overrides exist only where lean. The option set is finite and authored: configurability means choosing among designed readings, never editing the grammar. why: appearance scattered per app is how a suite stops looking like one thing. One home, inherited everywhere.

2026-10-17 · accepted (design lead direction, same session)

From one seed, the base lane derives a named family of variants: faithful (default), soft, vivid, mono. Variants differ in how loudly they read the seed, never in grammar; all pass the same governor and accent law. Authored palettes are whole other stories in their own lane, not variants. why: platforms that derive colour offer stories, not a single answer; a family makes the base lane a place to land, not a compromise to escape.

2026-10-17 · accepted (verdict by delegation, appendix a item 7)

The governor’s per-role chroma clamps are ratified as the approach, with starting values from the annex and gaps work. The first real surfaces running the dynamic base lane tune the numbers under the codification cadence; they freeze once two surfaces agree. Ungoverned derivation remains an anti-steal. why: numbers frozen before contact with a real desk would be fiction with decimals. Earned numbers or none.

2026-10-17 · accepted (verdict by delegation, appendix a item 6)

The theme schema’s adaptive field is the follow-the-sun / OS-sync opt-in flag: when set, the surface may follow the operating system’s light/dark and scheduled shifts. It is an option under options-where-lean (zero idle cost, authored default unchanged). why: an undefined field in a schema is a lie the schema tells every reader. Defined, it earns its place; the alternative was deletion.

2026-10-17 · accepted (verdict by delegation, appendix a item 5)

A valid theme resolves every token in the vocabulary. The loader adopts the porter’s rule: no silent default-filling. A theme that fails renders in the degraded state (named pattern): what still works, what is disabled, one recovery action. why: silent filling made two tools disagree about the same file. Invalid-but-designed beats valid-by-accident.

2026-10-17 · accepted (verdict by delegation, appendix a item 4)

Friction is proportional to reversibility and blast radius: reversible actions are frictionless; confirmations name the object and what it takes with it; the least reversible actions carry the most deliberate gates. The four existing destructive behaviours are to be audited against the ladder’s rungs. why: four surfaces invented four answers to the same question. One ladder makes the next surface’s answer a lookup, not an invention.

2026-10-17 · accepted (verdict by delegation, appendix a item 3)

The keep-or-revert countdown: range 5 to 60 seconds, default 15, user-settable. Automations and self-healing skip it, and that skip list is written doctrine, not build behaviour nobody ratified. The 5-second floor is safety-relevant and may not be configured away. why: a safety mechanism whose exceptions live only in code is a deviation waiting to be discovered the hard way.

2026-10-17 · accepted (verdict by delegation, appendix a item 2)

The motion annex’s named easing curves enter the token core as its easing tokens. Every layer reads curves from the one motion source. why: two motion sources is how durations drifted apart in the first place.

2026-10-17 · accepted (verdict by delegation, appendix a item 1)

The v2 value line (card radius 10, card border white 9%, brass #AC8A3C, no solid chip fill) governs everywhere; v1 values are killed wherever legacy files still state them. Radius may vary by theme: the cinema theme’s 14/12 stands as a ratified theme-level deviation, the core value remains 10. why: the token core already carried the v2 line; the open residue was legacy files and the cinema question. Killing explicitly ends the two-specs problem; the deviation keeps a loved theme honest instead of forcing it into the core’s shape.

2026-10-16 · accepted (earned on the bezel popover)

A visual representation (a canvas, a preview) carries glanceable state badges only. The actions for the selected thing live on that thing’s toolbar line. why: settled on the HDR placement call: the badge (state) sits on the picture, the button (action) sits with its fellow actions. A picture that grows controls becomes a switchboard and stops being a picture of the thing it represents.

2026-10-16 · accepted (earned on the bezel popover)

Icon-only is correct for identity (scene chips, things users learn as theirs). Action buttons get text labels: every verb on a toolbar must be nameable at a glance, and no control may rely on a tooltip to be understood. A glyph that argues with its label gets swapped. why: the person who specced the app misread the rotate glyph as “reset” while judging the wired build. If the design authority cannot read a verb at a glance, a stranger never stood a chance.

2026-10-16 · accepted (term and rule shape; the full teaching

doctrine is an open gap, see the gaps inventory) Furniture: elements that persist as decoration after their job is done. The rule shape: every element is state, action, or on its way out. Teaching chrome (hints, legends) appears in context and retires once taught. why: the word and the call are the design lead’s, made while judging the wired popover: its permanent keycap legend is the type specimen. A hint rented a permanent row keeps charging rent forever.

2026-10-16 · accepted (earned on the bezel popover)

A surface fits the space it is given by default, at every size it claims to support. A manual density or size override may exist as a settings backup; it is never the mechanism usability depends on. why: judged live on the popover (“it should just automatically scale as much as possible”). If a surface only works after the user fiddles, the surface is wrong, not the user.

2026-10-16 · accepted

The first app builds in-house to its private ship; the fleet works the design track in parallel; the engine rewrite is released only when the pipe protocol freezes at the private ship. One modification: the design gate is per new surface, not global. A brand-new surface type gets one quick design check before it is built; existing surfaces wait for nothing. why: the shipping build already runs on settled law (tokens, accent law, anatomy, prototype), so parking it would stall it on a document that mostly codifies what is in use. Ratification runs on consent-based claims with unknowable latency, the least controllable clock in the system. And an early rewrite would freeze protocol verbs (diagnostics, guard, porter, remote) that design-led features are still shaping; the budgets the rewrite needs are already law.

2026-10-16 · accepted

Every topic is written as principle (generic, portable, buildable from by a stranger), then rule (glaze’s binding numbers, tokens, gates), then a worked example on a real surface. why: generic guidance is how the greats scaled to thousands of strangers, and our contributors also arrive cold. Generic fails only when it substitutes for the rule beneath it.

2026-10-16 · accepted

Release versioning and tags for the suite use calendar versioning, not SemVer. why: the suite ships on a calendar cadence and makes no API compatibility promises that SemVer exists to express.

2026-10-16 · accepted

Design material is born and kept here, not in working folders or chat. An open pull request is a proposal; merging it is what makes its contents law. The design lead merges. why: a constitution that lives as loose files has no history, no diffs, and no stable links for contributors to cite. The merge queue is the verdict queue.

2026-10-16 · accepted

The constitution lives as versioned markdown in this repo, rendered as a small static searchable site in the Material/Carbon shape, roughly thirty checkable pages. why: an unversioned wiki rots silently and cannot be gated. We compete on narrowness, strictness, and CI enforcement, not volume.

2026-10-16 · accepted

An option that costs zero at idle and never changes the authored default is welcome (derived themes, glass strength, follow-the-sun). An option that costs frames, polling, or identity churn is a tax and is judged as one. why: options are not free or expensive as a class; the cost shape decides. Calm authored defaults stay the product.

2026-10-16 · accepted

Where hardware exists, haptics are designed with the same care as colour and motion: a small, closed, optimal vocabulary, restrained, never ambient, never the sole signal for anything. why: the mandate was explicit (“haptics are so fucking good, make sure optimal haptics are utilized in glaze”), and the research bears it out: platforms reward a closed outcome vocabulary and punish decoration buzz.

2026-10-16 · accepted

Everything authored in glaze is vector and resolution independent (SVG, glyph, and shape sources). Raster exists only as a fresh render from vector at the exact target density, never an upscaled asset. Photos and screenshots are the only inherently raster material and are never interface assets. why: interface elements must stay clean from 16px tray size through retina and fractional scaling; an asset that only works at one resolution is a future bug filed in advance.

2026-10-16 · accepted

The suite’s design language is called glaze: one word, lowercase, a bare noun in the family of Material, Fluent, Carbon. why: a glaze is a thin translucent layer of colour over a base, which is the accent law itself (tints over surfaces, never solid fills, capped thin by rule). The name states the doctrine. The slang double meaning was judged a feature: memorable, funny, ours.