One declaration does three jobs: renders the panel, carries the defaults, names
the values that come back. A module writes no DOM and reads no DOM.
Validation refuses rather than repairs -- unknown type, a renderer its type does
not have, a label that is not text, a default outside its own bounds, a when
naming a key the module never declared. A module that is wrong does not get a
best-effort panel; it does not load, and says why once.
Ordering is by declared relation and stage, never priority numbers, and a cycle
drops only the modules in it. Compatibility is by trait, never model name.
The shell hands a module { composer, values, on, shell } and nothing else: no
node, no document, no kit internals. It cannot style anything because it is
never given anything that could.
catalogue/hide.html puts one good module and five broken ones through the real
shell and shows the result: one panel, five absent, no placeholders. The lint
fixtures make the scanner prove it catches each rule, so a clean scan means
something.
First slice: modules/system/appearance. Two settings, an optional ui.js, and
clicking Light actually turns the app light.
Cleaned scales from v4's measured usage: 11 control heights to 4, 19 radii to 6,
9px named as a real type step, one reduced-motion guard because every duration
is a token now.
Derived tokens are declared on [data-theme] as well as :root -- a custom
property's var()s are substituted where it is declared, so on :root alone a
scoped light subtree inherits the dark accent.
The catalogue reads the tokens out of the stylesheet instead of listing them, so
it cannot drift; anything it has no renderer for shows up as Ungrouped.