> ## Documentation Index
> Fetch the complete documentation index at: https://docs.findmydata.io/llms.txt
> Use this file to discover all available pages before exploring further.

# UX redesign — design language & review decision control

> Round-2 decisions: the Registry visual identity (archive paper, iron-gall ink, ledger green, pencil-vs-ink provenance grammar, seal motif, Besley/Libre Franklin/IBM Plex Mono, icon system) and the Ask-Then-Refine review decision control (three plain-speech cards, no numbered shortcuts, earned keyboard hints).

# Find My Data — Final Design Specs

**Synthesis of 3 identity proposals × 3 input proposals × 3 judge verdicts**

**Verdicts:** Identity — **Registry** wins (2 of 3 first-place votes, 98 vs 95 total points over Sounding Line; Signal Instrument unanimous last but heavily strip-mined for grafts). Input — **Ask, Then Refine** wins (unanimous first place from all three judges; the only disagreement was second place, which is moot).

***

## Part 1 — Design language: **Registry** (+ grafts)

### 1.0 Resolving the judge split

Judge 1 (persona lens) ranked Sounding Line first; Judges 2 (brand) and 3 (engineering) ranked Registry first. Registry wins for three reasons:

1. **The dissent was about cost, not fit.** Judge 1 scored Registry personaFit 8 — equal to Sounding Line. The objections were the first-session "pencil vs. ink legend" tax and build cost/fragility. Both are fixed below by grafts: the provenance grammar is made redundant with always-present text labels (nothing to learn — the legend becomes a passive tooltip, not training), and the three fragile/expensive elements (6px hatch bar, 10 custom glyphs, prose-only discipline rules) are replaced by the discrete cell gauge, a 4-glyph custom set, and mechanical token/lint enforcement.
2. **Two judges independently called Sounding Line's look the category/AI default.** "Bioluminescent teal on deep navy" is what Varonis/BigID/Purview already own and what every AI generator emits; even Judge 1 conceded its distinctiveness "rests heavily on the metaphor." Registry is the only proposal a competitor can't ship next quarter — green-and-paper in a blue-and-dark category.
3. **Registry's aesthetic IS the product's trust model.** AI proposes in pencil, the owner confirms in ink, the domain gets sealed — provisional-vs-confirmed encoded in the material itself. That is the founder's "Find it. Confirm it." rendered as a visual system, not decoration.

Signal Instrument is rejected as an identity (its own risk list: "hacker tool… poison for a businessperson handling HR data"; its rescue was hiding the identity from the primary persona) but four of its mechanisms are grafted in below.

### 1.1 Final token sheet

Every color ships as a role token with a light/dark pair. Components reference roles only. (Note: the dark ground hex was corrupted in the source JSON as `#12171\n4`; corrected to `#121714`.)

| Token               | Role                                                                                   | Light                                   | Dark                                  |
| ------------------- | -------------------------------------------------------------------------------------- | --------------------------------------- | ------------------------------------- |
| `--ground`          | app canvas                                                                             | `#f4efe4` (Archive Paper)               | `#121714`                             |
| `--surface`         | cards, panels, table bodies                                                            | `#fdfbf4` (Vellum)                      | `#1a201c`                             |
| `--surface-inset`   | evidence wells, input wells                                                            | `rgba(38,34,27,0.03)` over surface      | `rgba(234,228,214,0.04)` over surface |
| `--ink`             | primary text, confirmed fills, redaction bars                                          | `#26221b` (Iron Gall, 13.9:1 on Vellum) | `#eae4d6` (warm paper — never white)  |
| `--ink-secondary`   | secondary text, meta                                                                   | `#5c564b`                               | `#b5af9f`                             |
| `--rule`            | hairlines (all structure)                                                              | `rgba(38,34,27,0.14)`                   | `rgba(234,228,214,0.12)`              |
| `--rule-strong`     | double rules, table-header totals rule                                                 | `rgba(38,34,27,0.28)`                   | `rgba(234,228,214,0.24)`              |
| `--accent`          | primary actions, active states, link hover, ok anchor                                  | `#1e5c48` (Ledger Green)                | `#4da583`                             |
| `--accent-contrast` | text on solid accent                                                                   | `#fdfbf4`                               | `#121714`                             |
| `--margin-rule`     | **structural red only**: active-nav double rule, evidence left rule, selected-row rule | `#a8342a`                               | `#c4544a`                             |
| `--crit-ink`        | **severity red only**: crit chips, overdue, blocked                                    | `#a8342a`                               | `#c4544a`                             |
| `--provisional`     | everything AI-proposed: chips, gauge cells, dashed borders, pencil glyph               | `#5f6660` (Graphite)                    | `#8b938c`                             |
| `--warn`            | warn chips, stale                                                                      | `#8a5a06` (Ochre)                       | `#c98f2e`                             |
| `--info` / `--link` | info chips, resting links                                                              | `#33608c` (Chart Blue)                  | `#7aa3cc`                             |
| `--spine`           | sidebar — **theme-constant**                                                           | `#14201b` (ledger cloth)                | `#14201b`                             |
| `--spine-label`     | sidebar labels                                                                         | `#f4efe4` (inactive at 72% opacity)     | same                                  |
| `--focus`           | focus rings: 2px outline, 2px offset                                                   | `#1e5c48` (on spine: `#f4efe4`)         | `#4da583`                             |
| `--overlay-shadow`  | overlays ONLY                                                                          | `0 8px 24px rgba(18,23,20,0.18)`        | `0 8px 24px rgba(0,0,0,0.45)`         |

Chip pairs (border+text at full token value, fill at tint; **text label always**, per the standing WCAG rule):

| Chip           | Light fill             | Dark fill                | Border style                        |
| -------------- | ---------------------- | ------------------------ | ----------------------------------- |
| ok             | `rgba(30,92,72,0.08)`  | `rgba(77,165,131,0.14)`  | 1px solid                           |
| warn           | `rgba(138,90,6,0.08)`  | `rgba(201,143,46,0.14)`  | 1px solid                           |
| crit           | `rgba(168,52,42,0.08)` | `rgba(196,84,74,0.14)`   | 1px solid                           |
| info           | `rgba(51,96,140,0.08)` | `rgba(122,163,204,0.14)` | 1px solid                           |
| ai/provisional | `rgba(95,102,96,0.08)` | `rgba(139,147,140,0.14)` | **1px dashed (3-2)** + pencil glyph |

Provenance grammar (system-wide invariant): **provisional = Graphite + dashed/hatched + pencil glyph + a text label ("AI", "Proposed"); confirmed = solid border + solid ink + label.** Pattern + hue + word — colorblind-safe and theme-proof by construction, and because the words are always present, no first-session legend is required (Judge 1's objection). A "pencil vs. ink" note lives in the help panel as a passive tooltip only.

All pairs validated ≥4.5:1 for text on their grounds, ≥3:1 for rules and chip borders. QA gates carried from the proposals: warm paper on low-gamut/cheap panels (light), warm-dark text pairs (dark).

### 1.2 Type stack

| Slot    | Face                               | Weights                                | Use                                                                          | Restriction                                                                                                                                                                                |
| ------- | ---------------------------------- | -------------------------------------- | ---------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| Display | **Besley** (OFL, variable)         | 500 / 600 / 900                        | page titles, module headers, stat-tile numerals, wordmark                    | **≥18px only** — enforced mechanically: Besley is loaded only by the `Display` component; a lint rule flags any other `font-family: Besley` (answers Judge 3's "no enforcement mechanism") |
| Body    | **Libre Franklin** (OFL, variable) | 400 / 500 / 600 (+SemiBold small-caps) | all UI text, tables, forms, chip labels, nav                                 | `font-feature-settings: "tnum"` on                                                                                                                                                         |
| Mono    | **IBM Plex Mono** (OFL)            | 400 / 500                              | paths, IDs, hashes, evidence excerpts, keycap hints, **all measured values** | —                                                                                                                                                                                          |

**Measured-values rule (graft from Signal Instrument, all 3 judges):** any number that measures something and is set **below 20px** — percentages, counts, confidences, timestamps, byte sizes — is IBM Plex Mono tabular. Measured numerals at display size (stat tiles only, ≥20px) are Besley Black tabular lining. This size gate reconciles Registry's Besley stat numerals with Signal's one-line signature rule.

Scale: 11 (small-caps labels/microcaps, 0.08em tracking) · 12 (mono meta) · 13 (dense body, tables, excerpts) · 14 (body, buttons) · 16 (card titles, Franklin 600) · 18 / 22 / 28 (Besley section / page / focus-pane doc titles) · 36 (Besley Black stat numerals). Line height 1.45 body, 1.2 display. 8px spacing grid.

### 1.3 Chrome

* **Sidebar ("the spine"):** 216px, decided IA untouched. `--spine` `#14201b` **constant across both themes** (graft from Sounding Line's sidebar-as-constant trick, per Judge 3: buys cross-theme brand continuity and deletes a region from dark-QA). Paper labels; nav group headers Franklin SemiBold small-caps 11px. Active item: the **double red margin rule** (2px + 1px, 3px apart) on the left edge in `--margin-rule` + label at 100% opacity. A 1px `--rule` edge separates spine from canvas in dark.
* **Domain switcher pill ("spine label"):** small Vellum tag (theme-constant, since it sits on the constant spine) with the domain's stable accent hue as a 3px stitched top edge; domain name Franklin 600. Under the tenant lens it swaps to a Graphite tag reading "All domains · Tenant" and the active-nav margin rule turns graphite — the SoD boundary reads as a material change (paper tag vs. pencil tag). Focus ring `#f4efe4`.
* **Surfaces:** depth from hairlines, not shadows. Exactly two elevations: surface (1px `--rule` border, no shadow) and overlay (batch drawer, attest side-panel, dropdowns, toasts — `--overlay-shadow`). The attest side-panel and evidence panels carry the double margin rule on their left edge.
* **Radius:** 3px cards/panels/buttons/overlays, 2px chips — cut paper, not soft plastic.
* **Density:** 40px table rows default; a 32px "compact" density is available on tenant/admin tables only. 12px card padding rhythm.
* **No gradients anywhere. No zebra striping. No decorative color.**

### 1.4 Motif — the registrar's seal

A circular notary rosette: fine radial engraving lines around a negative-space checkmark, drawn at the system's 1.25px hairline weight. **Exactly four sites, nowhere else:**

1. **Logomark** (works at 16px favicon).
2. **Attestation** — "Attest this domain" stamps the seal onto the posture snapshot (motion 1 below); attested domains carry a small static seal glyph beside their name.
3. **Empty/complete states** — 8%-opacity watermark behind "Queue clear — nothing waiting on you" and "No open findings": emptiness as entered-and-closed, not absence.
4. **Scan progress** — the seal's radial lines fill clockwise as determinate progress; indeterminate pulses the lines at 8% opacity amplitude.

Never wallpaper, never in tables or chips (sole exception: the attested-domain glyph). Scarcity is the brand.

### 1.5 Icon system

**Style:** stroke icons at **1.25px** — matching the hairline rule weight so icons read as engraved marks; squared terminals; `currentColor`; no fills, no duotone, no illustration system. Base: **Lucide** (ISC) with stroke-width overridden to 1.25. Custom glyphs cut from \~10 to **4** (Judge 3's cost objection): `seal`, `stamp`, `pencil` (provenance), `redaction-bar`.

**The 14 icons the IA needs** (20px grid, nav + utility):

| #  | Icon                              | Use                                             |
| -- | --------------------------------- | ----------------------------------------------- |
| 1  | house                             | My Domain · Overview                            |
| 2  | inbox                             | Review queue                                    |
| 3  | database                          | Data inventory / map                            |
| 4  | wrench                            | Remediations                                    |
| 5  | seal (custom)                     | Attestation                                     |
| 6  | layout-grid                       | Tenant · Domains                                |
| 7  | plug                              | Sources & connectors                            |
| 8  | scale                             | Policies                                        |
| 9  | scroll-text                       | Reports & audit                                 |
| 10 | activity                          | Operations & scans                              |
| 11 | users                             | Access & users                                  |
| 12 | settings                          | Settings                                        |
| 13 | search                            | global search                                   |
| 14 | x / chevron-down / arrow-up-right | close, disclosure, external link (utility trio) |

Chip glyph set (12px grid, always paired with the mandatory text label): check, alert-triangle, octagon-alert, info, pencil (provisional). Registry's rule beats Signal's chip-icon ban: the glyph is a third redundant channel alongside text and hue, strengthening the WCAG rule rather than recreating the problem.

**Banned:** icons in table data cells (source/object type renders as mono text, not a glyph); icon-only buttons anywhere decisions happen (the six decide verbs are always labeled); duotone/filled styles; emoji; icons in body copy.

### 1.6 Component treatments

* **Stat tile:** flat Vellum, hairline border, Besley Black 36px tabular numeral in `--ink`, Franklin small-caps 11px label above. Semantic state = a 2px underline rule beneath the numeral (`--accent` / `--warn` / `--crit-ink`) plus the sub-chip — never a colored tile background. Whole tile is a link; hover draws the underline to full width. Coverage-movement subline ("62% → 71%") in Plex Mono, `--accent`, 500.
* **Chips (inked stamps):** 2px radius, per §1.1 table, 11px Franklin SemiBold small-caps label always, 12px glyph. Confirmed = solid; provisional = dashed graphite + pencil. Numeric content inside chips ("AI 0.87") is Plex Mono.
* **Confidence gauge (graft from Signal, endorsed by all 3 judges — replaces Registry's 6px hatch bar, which is a sub-pixel hazard):** **10 discrete cells** (tables: 4×8px cells, 1px gaps; review card: 8×12px cells, 2px gaps). Filled cells solid `--provisional`, empty cells `--rule`; a 1px `--ink` threshold tick at the auto-accept threshold; exact value beside it in Plex Mono ("0.87") — never the gauge alone. Hover explainer: "ensemble estimate." **On confirmation the gauge is replaced by an ink line** — "Confirmed by you · 12 Jul 2026" in `--accent` with a solid check (the Sounding Line human/machine swap, re-skinned as pencil-bar-becomes-ink-line per Judge 2's graft). Graphite is machine, green is human, everywhere. Hatch texture is banned below 8px thickness; it survives only in the home-page provenance-mix bar (≥12px tall), solid ink vs. graphite hatch segments.
* **Evidence row:** 13px Plex Mono excerpt on `--surface-inset`, **double red margin rule** on the left (`--margin-rule`, structural). Matched spans: 600 weight + dashed underline + 10% Graphite wash (pattern + weight, not color alone — machine-found spans are provisional, so they wear pencil). Redacted spans: solid `--ink` bars with 1px rounded ends (dark: `#060806` bar + 1px `--rule` outline). Meta footer (source · path · first\_seen) in 12px mono; source link in `--link`.
* **Tables:** true ledger paper — horizontal hairlines only, no zebra, no vertical rules except an optional red margin rule left of the row-actions column. Header: small-caps 11px over a double hairline (the totals rule: 1px + 1px, 2px apart), sticky. 40px rows (32 compact). Numerics right-aligned Plex Mono tabular. Hover `rgba(30,92,72,0.04)` (dark: accent at 6%). Selected row = double margin rule + hover tint. Sort indicator: mono ▲ glyph, not an icon.
* **Review card:** "the entry being recorded" — Besley 22px document title, provenance chip row, evidence block, confidence gauge, then the decision control from Part 2 skinned as stamp-buttons (commit = solid `--accent` with stamp glyph; denial = 1px `--crit-ink` outline; quiet paths = text-buttons).
* **Buttons:** 3px radius, Franklin 600 14px, 36px height (40px for the review commit). Primary = solid `--accent` / `--accent-contrast` text; secondary = 1px `--ink` outline; tertiary = text-button, underline on hover; destructive = `--crit-ink` outline. Active state = stamp press: translateY(0.5px) + one-frame ink-bleed ring. Focus per `--focus`. Disabled at 38% opacity, never removed from tab order silently.
* **Toast:** overlay elevation, Vellum/`#1a201c`, hairline, 3px radius; Undo action in `--accent`; 8s.

### 1.7 Motion

All ≤300ms; under `prefers-reduced-motion` every entry degrades to its stated static end-state (instant swap / hard cut). Nothing else in the product moves — tables, chips, gauges are still.

| # | Moment                            | Trigger                                                                                                                                                           | Spec                                                                                                                                                                                                                                      | Reduced-motion                        |
| - | --------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------- |
| 1 | **Seal press**                    | "Attest this domain"                                                                                                                                              | rosette scales 1.1→1.0, 240ms cubic-bezier(0.2,0,0,1), one-frame ink-bleed ring, then persists static with timestamp                                                                                                                      | seal + timestamp appear instantly     |
| 2 | **Pencil becomes ink**            | any decision commit; family propagation                                                                                                                           | dashed border animates dash-offset to solid `--accent`, 200ms linear; family batch: affected rows resolve in 40ms stagger, **capped at 8 visible rows** (Signal's cap grafted), while the toast counts up ("12 identical copies updated") | instant solid swap + toast text       |
| 3 | **Ruling off**                    | queue reaches zero; also on "Finish sitting" (summary screen)                                                                                                     | one hairline draws itself left-to-right, 300ms ease-in-out, above "Queue clear — nothing waiting on you", 8% seal watermark behind                                                                                                        | line appears drawn                    |
| 4 | **Press fills**                   | active scan (connector freshness, Operations)                                                                                                                     | seal radial lines fill clockwise (determinate); indeterminate = 8% opacity pulse, slow                                                                                                                                                    | static partial fill + percentage text |
| 5 | **Domain-switch / step-2 reveal** | domain switch: 120ms opacity crossfade of canvas + tag swap. Step-2 reveal in the review control: **deliberately instant (\<100ms), no animation in either mode** | hard cut (already the spec)                                                                                                                                                                                                               |                                       |

### 1.8 Enforcement (governance grafts — Judges 2 and 3, independently)

1. **Token-name split** (generalizing Sounding Line's `lumen-on-deep` trick): `--margin-rule` and `--crit-ink` are separate tokens with identical values; using `--crit-ink` outside severity components or `--margin-rule` as anything but a 1–2px vertical rule is grep-able/lint-visible. Registry's prose "position rule" becomes mechanical.
2. **Semantic-token import boundary** (from Signal): `--crit-ink`, `--warn`, `--info`, `--provisional`, ok-anchor usage of `--accent` are importable only by chip/gauge/rule/severity components. One lint rule protects both the severity semantics and the pencil/ink grammar from decorative reuse.
3. **Besley component gate** per §1.2; **hatch minimum-size rule** per §1.6.

### 1.9 Delta vs. current tokens

| Current                                 | Becomes                                                                                       |
| --------------------------------------- | --------------------------------------------------------------------------------------------- |
| deep-navy `#0b1f33` sidebar             | spine ledger-cloth `#14201b`, theme-constant                                                  |
| discovery-teal `#0f766e` primary        | Ledger Green `#1e5c48` / `#4da583`                                                            |
| connection-blue `#2563eb` links         | Chart Blue `#33608c` / `#7aa3cc` resting; hover goes `--accent`                               |
| insight-violet `#6d28d9` AI/confidence  | Graphite `#5f6660` / `#8b938c` **+ dash/hatch/pencil grammar** (hue-only → material metaphor) |
| confirm-mint `#5ead9a` active-nav       | deleted; active-nav = double red margin rule                                                  |
| canvas-mist `#f2f8f7` / cloud `#f8fafc` | Archive Paper `#f4efe4` / Vellum `#fdfbf4`                                                    |
| ink `#0f172a`, slate `#475569` (cold)   | Iron Gall `#26221b`, `#5c564b` (warm)                                                         |
| Inter / JetBrains Mono                  | Libre Franklin / IBM Plex Mono, + Besley display (new)                                        |
| 8px radius, card shadows                | 3px (2px chips), hairlines; shadow on overlays only                                           |
| single theme                            | full light/dark role-pair token sheet (net new)                                               |
| chips: text-always (kept)               | kept, + provenance dash grammar as a new redundant axis                                       |
| no motif/motion/icons specified         | seal motif (4 sites), 5 motion moments, Lucide-1.25 + 4 customs                               |

### 1.10 Grafts applied (source → purpose)

1. Signal → 10-cell discrete confidence gauge with threshold tick + printed numeral (all 3 judges).
2. Signal → measured-numbers-are-mono-tabular rule (all 3).
3. Signal → semantic-token lint boundary (all 3).
4. Sounding Line → token-name enforcement pattern, applied to Margin Red's dual role (J2, J3).
5. Sounding Line → theme-constant sidebar (J3).
6. Sounding Line → confirmed-swap: gauge becomes "Confirmed by you · date" ink line (J1's idea, J2's Registry re-skin).
7. Registry native, kept per J1's grafts-in-reverse: seal-press attest ceremony, ruling-off queue-clear reframe.

***

## Part 2 — Review decision control: **Ask, Then Refine** (+ grafts)

### 2.0 Verdict

Unanimous winner. Its core mechanism — "the two-step structure is itself the confirmation dialog," with the commit button restating the complete outcome — is the strongest wrong-confirm defense proposed anywhere, and it directly answers the founder's ground-truth fear with zero modals. Split-Verb loses on the exact axis the founder named (its own risk list: the giant one-click Yes produces "false confirms — exactly the ground-truth pollution the founder fears"); Read-Back loses on the unproven editable-chip affordance and the weakest API fit. Both are strip-mined below.

**Direct answers to the founder's three questions:**

* *Should we offer keyboard shortcuts at all?* Yes — but mnemonic letters only, **invisible by default**, revealed only to people who use them. The mouse path is the complete, primary path.
* *Is there a better way to gather the decision?* Yes: ask the one question the owner actually holds ("Is this your team's data?"), then at most three refinements phrased as completions of their answer. Nobody ever faces six choices.
* *Will users be confused by the numbers?* The numbers are gone. Numbered badges never appear anywhere.

### 2.1 Control structure and exact labels

Sticky at the bottom of the focus pane, below the evidence block (which never moves — reserved layout).

```
[family banner, when applicable]
  "Your answer will apply to 12 identical copies · review copies"

STEP 1 — header: "Is this your team's data?"
  ┌────────────────────────────────────────────┐
  │  ✓  Yes, it's ours                         │   (ink outline, green check)
  ├────────────────────────────────────────────┤
  │  ✕  No, not ours                           │   (ink outline, ink x)
  ├────────────────────────────────────────────┤
  │  ?  I can't tell yet                       │   (graphite DASHED outline —
  └────────────────────────────────────────────┘    deferral is provisional, pencil grammar)

STEP 2 (in place, &lt;100ms, zero layout shift; chosen card collapses
to breadcrumb chip "Yes, ours · change"; options land under the pointer)

  Under YES (stable order, never reordered by frequency/confidence):
    ▸ [PRIMARY, solid Ledger Green, stamp glyph]
        "Confirm: Employee salary data"        (+ " — all 12 copies" on families)
    ▸ "Ours, but it's a different type…"       → inline type picker
    ▸ "Ours, but it isn't sensitive"
    ▸ [quiet] "None of these — go back"        (also Esc)
    ☐ "Contribute as a confirmed example"      (session-sticky; effect named in toast)

  Under NO:
    ▸ "There's no salary data here"            (interpolated live proposed type)
    ▸ "It belongs to another team…"            → optional "Send to… (optional)" picker
                                                 + note "This sends it to the Finance
                                                 owner's queue."
    ▸ "It's ours — just not sensitive"         (kind-4 CROSS-LISTED; commits kind 4
                                                 directly, no bounce-back)
    ▸ [quiet] "None of these — go back"

  "I can't tell yet": commits immediately (1 click).
    Toast: "Flagged — we'll gather more evidence."  + optional "Add a note for the analyst"
```

Type picker detail (grafts): AI runner-up classifications listed first (Split-Verb), then the domain's known types, search field at 6+. Hovering/focusing a type row live-previews the diff in the breadcrumb sentence — old type struck through, new highlighted (Read-Back) — and the row commits as the correction on click (winner's 3-click count preserved).

Engineering ship-gates (Judge 1 called these blockers, Judge 3 confirmed testable): step-2 reveal \<100ms with zero layout shift (step-2 container height pre-reserved at the tallest branch); evidence block position immutable.

### 2.2 Full 6-kind mapping

| Server enum           | Path                                                                                                                           | Exact commit label                                              | Clicks                                      | Keys                                      | Payload extras                                                                                                                             |
| --------------------- | ------------------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------- | ------------------------------------------- | ----------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------ |
| `yes-mine`            | Yes → primary                                                                                                                  | "Confirm: \[proposed type]"                                     | **2** (Shift-click on "Yes, it's ours" = 1) | Y, Enter                                  | training-example flag if checked                                                                                                           |
| `mine-different-type` | Yes → "different type…" → pick                                                                                                 | row commit under "Save correction:" header; diff previewed live | **3**                                       | Y, ↓↓, Enter, then arrows+Enter in picker | chosen type id                                                                                                                             |
| `another-domains`     | No → "It belongs to another team…"                                                                                             | as labeled; consequence note shown pre-commit                   | **2** (3 with domain picked)                | N, ↓, Enter                               | optional target domain id                                                                                                                  |
| `mine-not-sensitive`  | Yes → "Ours, but it isn't sensitive" **or** No → "It's ours — just not sensitive" (cross-listed, ships day one — all 3 judges) | as labeled                                                      | **2**                                       | Y/N, ↓↓, Enter                            | —                                                                                                                                          |
| `not-a-match`         | No → interpolated denial                                                                                                       | "There's no \[salary data] here"                                | **2**                                       | N, Enter                                  | optional free-text "what is it actually?" — **verify the decision payload carries a comment field; if not, drop the field, not the label** |
| `need-more-evidence`  | Step-1 card                                                                                                                    | "I can't tell yet"                                              | **1**                                       | C                                         | optional analyst note (same payload caveat)                                                                                                |

Every commit posts exactly one unchanged enum value; Shift-click and the pattern chip are shortcuts to enum values, never new states, and are logged identically for audit.

### 2.3 Priya's Tuesday (43 items, one 12-family, \~75 percent confirms)

\~33 confirms × 2 clicks + 12-family resolved in 2 clicks + edges at 2–3 + can't-tells at 1 ≈ **80 clicks, near-zero pointer travel, zero modals, zero doubts about what was pressed**. Shift-click or Y+Enter roughly halves it for repeat users. Queue header counts honestly: **"7 of 43 items · 31 decisions"** (Read-Back graft).

### 2.4 Keyboard spec

| Key                          | Action                                                                                                                                    |
| ---------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------- |
| Y / N / C                    | step-1 cards (first letter of the visible word; C = "can't tell". The proposal's original "U" mapped to no visible word and is corrected) |
| ↑/↓ + Enter                  | step-2 focused radio group; Enter alone = the visible primary                                                                             |
| Esc                          | back out of step 2, commits nothing                                                                                                       |
| ↓/↑ (j/k silent aliases)     | queue next/previous                                                                                                                       |
| Z or Cmd/Ctrl+Z              | undo last decision (even after auto-advance)                                                                                              |
| ?                            | shortcut sheet (lists everything incl. Shift-click)                                                                                       |
| Shift+click "Yes, it's ours" | 1-click confirm-as-proposed; tooltip- and ?-sheet-advertised only                                                                         |

**Suppression and safety rules:** all decision accelerators inert for **400ms after any card transition** (Split-Verb graft — a double-tap cannot decide two cards); accelerators inert while any picker, menu, or text field has focus (falls out of the focused-radio-group scoping, but stated as a hard rule); Enter never fires the primary without explicit focus on the control (no rubber-stamping by mashing Enter). Tab/Enter DOM operability is table stakes underneath, unchanged.

**Hint-reveal ladder (Split-Verb's, grafted verbatim — the definitive answer to the numbered-badge complaint; all 3 judges):**

1. Default: **zero badges**. A first-time HR director sees three plain-speech cards and nothing else. Numbers never appear, ever.
2. Hovering any button \~700ms shows a tooltip that includes its key.
3. After \~10 mouse-only decisions in one session, one dismissible coach-mark: "Going fast? Y, N and Enter work here. Press ? for all keys." Dismissal remembered forever.
4. Pressing any accelerator (or opening ?) permanently enables small Plex Mono keycap glyphs in the buttons — a saved preference, toggleable via a "⌨ Shortcuts" control in the pane header.

### 2.5 Batch / family integration

* **Scope declared before the decision:** banner between evidence and step 1 — "Your answer will apply to 12 identical copies · review copies" (link opens the IA's batch drawer with sampled excerpt peeks).
* **Scope restated ON the commit button** (Read-Back via Judge 3): "Confirm: Employee salary data — all 12 copies". Every path carries the suffix, including denial and can't-tell (which flags the whole family, so duplicates never resurface one by one).
* Toast: "Confirmed as salary data — 12 identical copies updated · Undo" — undo reverts the family as one unit. Visual: pencil-becomes-ink stagger (motion 2), 40ms, capped at 8 visible rows + counter.
* **Near-duplicates never auto-propagate:** after deciding the head item, the drawer offers "Apply this answer to N similar items?" as an opt-in per-member checkbox list with excerpts; honors the `review.batch` capability gate; falls back to client-side sequential decides with progress if batch verification fails (IA §6).
* "Review copies individually" link splits the family for the rare mixed case. Family = one queue step.

### 2.6 Undo and error design

Layered, no confirm dialogs anywhere:

1. **Structure:** the second click always names the complete outcome with the proposed type restated — a slip on step 1 commits nothing and costs one Esc. The only 1-click path from step 1 ("I can't tell yet") is deliberately the only non-labeling, fully reversible verb.
2. **Undo:** 8-second toast with Undo on every commit (family-wide when propagated) + Z/Cmd+Z; a "Decided this sitting" rail lets any decision be reopened and superseded until consumed downstream.
3. **End-of-sitting summary (Read-Back graft — all 3 judges, "the cheapest ground-truth QA gate available"):** "38 confirmed · 2 corrected · 1 sent to Finance · 2 need evidence", grouped by outcome, families as single rows with copy counts, every row reopenable. "Finish sitting" triggers the ruling-off moment (motion 3) — the ledger page closes. The seal is NOT used here; it stays reserved for attestation.
4. **Counter-signal speed bump (Read-Back graft):** committing "There's no \[type] here" against confidence ≥ the high threshold (e.g., 0.85) surfaces a non-blocking inline "Optional: what is it actually?" field — styled as a pencil-annotation (graphite, dashed underline) per Judge 2's cross-track graft.
5. **Pattern chip:** "Same as last time: 'There's no salary data here'" appears after 3 consecutive identical full paths; always shows full outcome text; never becomes the Enter default; self-retires after 10 consecutive uses. Kept, with instrumentation (below) as the tripwire.
6. **Server prerequisites (all 3 judges, same words):** the Undo toast and session supersede require a **decision-revision endpoint**, and revised/undone decisions must be excluded from training exports via an **export watermark**. "Without them the toast's Undo would be a lie and must not ship." If they don't land, the fallback is honest: no Undo affordance at all, summary screen read-only. See contested call 2.
7. Commit failure: card returns to its step-2 state with picker choices intact and an inline "Couldn't record — retry."

### 2.7 Empty and edge states

* **Thin evidence:** a graphite pencil-note banner above step 1 — "Limited evidence — only 1 excerpt found"; the confidence gauge's mostly-empty cells already say the same; "I can't tell yet" gains the sub-caption "This will request deeper scanning." Card sizes never change (no biasing the layout).
* **Need-more-evidence lifecycle:** item moves to a visible "Waiting on evidence" tray in the queue pane; queue count decrements honestly. On return, it re-enters flagged with an info chip "New evidence added"; new excerpt rows carry a dashed graphite left rule + "added \[date]" mono meta so the delta is scannable.
* **Queue clear:** ruling-off moment; copy "Queue clear — nothing waiting on you." + "Ruled off — 43 items decided this sitting" linking to the summary. 8% seal watermark.
* **First run:** no tour, no auto-opened menus — the labels are the interface and the full answer space is visible within two cards. The ? sheet and help-panel "All possible answers" link cover the rest.
* **Touch/tablet:** step-1 cards and step-2 rows are full-width, ≥44px targets — the pattern survives touch unchanged (a structural advantage over Split-Verb's chevron, noted for the record).

### 2.8 Instrumentation (canary grafts — all 3 judges)

Launch metrics, compared against the flat-6 baseline: (1) `mine-different-type` and `mine-not-sensitive` usage rates — detects buried-kind atrophy, the shared failure mode of every nested pattern and the most valuable retraining signal; (2) step-2 back-out rate by branch — detects the kind-4 "reads as a No" branch-model mismatch; (3) confirm-rate anomalies and confirm-overturn rate — detects rubber-stamping; (4) `need-more-evidence` rate — detects cheap-escape drift; (5) pattern-chip usage vs. subsequent overturns.

### 2.9 Grafts applied (source → purpose)

1. Read-Back → end-of-sitting summary screen (all 3). 2. Split-Verb → interpolated denial label, locked as a hard rule for kind 5 (all 3). 3. Split-Verb → 400ms post-transition debounce + focus-scoped accelerator suppression + no-blind-Enter (all 3). 4. Split-Verb → earned-hints disclosure ladder (all 3). 5. Read-Back → counter-signal speed bump (J1, J2). 6. Read-Back → effective-decision queue math (J1). 7. Read-Back → scope printed on the commit button (J3). 8. Read-Back → live diff preview in the type picker (J2). 9. Split-Verb → AI-runner-ups-first picker ordering (J3). 10. All judges → canary instrumentation. 11. Cross-track → pencil-becomes-ink stagger as the family-commit visual (all 3). 12. ATR's own fallback promoted to day-one spec → kind-4 cross-listed under both branches (J1, J2).

***

## Contested calls for the founder

**1. The register bet: warm-archival (Registry) vs. familiar premium-dark (Sounding Line).** Two judges say green-and-paper is the only ownable identity in a blue-and-dark category and that its metaphor is your actual trust model; the persona judge and Registry's own risk list say a slab-serif paper world can read "heritage" to security buyers who expect modern gloss — and you asked for "modern and exciting." This is a positioning bet only you can underwrite: distinctive-and-polarizing vs. safe-and-crowded. It also has a cost dimension — Registry is the most expensive rebuild, Sounding Line the cheapest (mostly a token swap). The recommendation stands (grafts have removed the fragility and training-tax objections; the escape dial is Besley usage, not the system), and Sounding Line remains fully specced as the runner-up. Decide the premise, not the pixels: do you want to be the only ledger in a market of dashboards?

**2. Undo's server scope: build the safety net first, or ship v1 without Undo?** The entire error story that makes the two-step control safe at speed — 8s Undo, session supersede, summary-before-harden — requires two server pieces beyond the fixed 6-kind enum: a decision-revision endpoint and a training-export watermark that excludes revised decisions. All three judges independently flagged it, quoting the proposal itself: without them "the toast's Undo would be a lie and must not ship." Option A (recommended): sequence the two endpoints before the control ships — they are the upstream fix for the ground-truth pollution you named as the core fear. Option B: ship the control with no Undo affordance and a read-only summary — honest, faster to market, but decisions become irreversible at click time and the design's main safety pitch is gutted. This is a roadmap-priority call, not a design call, which is why it's yours.