A visual contract becomes operational when components, representations, and services agree about state, ownership, and evidence. This page supplies the shared execution spine for both presets: retain useful work, place each remedy with its owner, release acquired resources, and reconcile durable outcomes.
1 · Three layers of tokens, one meaning contract
Primitive tokens name material values: color, spacing, type, radius, duration. Semantic tokens name a purpose: control boundary, focused position, selected record, issue text, pending operation. Component tokens bind that purpose to a particular field, drawer, chart, table, or action rail.
Version the semantic meaning alongside the value. A package can keep the same color and still change behavior through a renamed role, announcement, focus policy, or command boundary. Record alias resolution, supported themes, density, state combinations, and migration guidance. Treat a changed state meaning as an API change.
primitive: signal.70
semantic: selection.rail
component: specimenTable.row.selectionRail
owner: selection model for the current view
meaning: current record position
service authority: separately evaluated by the receiving commandTheme roots scope their custom properties. Portals and embedded tools inherit an explicit theme/density boundary. Server-rendered initial values and client values share one binding. Test long labels, text zoom, forced colors, reduced motion, nested themes, and the actual focus-adjacent surfaces.
2 · Model independent state dimensions
Keep interaction, observation, request, authority, and draft continuity as separate dimensions. A selected record can contain stale evidence; a focused button can be awaiting permission; a retained draft can coexist with a failed transport attempt. A combined status model admits only the combinations the receiving workflow can explain.
The component model chooses the representation. The service model chooses permission and durable outcome. A successful parse establishes syntactic fit; a successful service receipt establishes the operation’s declared outcome. Service contract translation and edge validation provide the owning reference.[1]
3 · Put an issue with its cause owner
Cause | Owner | Component behavior | Recovery and oracle |
Incomplete syntax | Field / parser | Persistent label, valid form, linked issue text | Repair one field; valid neighboring values remain intact |
Cross-field constraint | Form / domain model | Summary links to affected controls | Re-evaluate the relevant constraint and preserve the draft |
Access decision | Service / authorization boundary | Explain the useful available route at fitting disclosure | A scoped access review or permitted alternative; service enforces policy |
Transport failure | Request adapter | Retain draft and name retry eligibility | Bounded retry for safe work; durable command reconciliation where needed |
Revision conflict | Service plus editing workflow | Name the used revision and retained draft | Compare/rebase or human review against the current revision |
Missing observation | Acquisition workflow | Unknown label, missing input, useful source path | New observation with source identity and revision |
Timeout after a command | Durable command owner | Outcome unknown; action identity retained | Receipt lookup with the same operation identity |
Service incident | Operational owner | One proportional notice and useful alternative | Audited incident handling and controlled re-entry |
This ownership split applies the form and service probe guidance to visual components.[2][1] The UI uses a stable issue identity for the field message, summary, announcement, and repair route. A server field path maps through a reviewed adapter to the public field identity. Localization supplies display wording; the stable code preserves machine meaning.
Error envelope at the receiving boundary
This design example awaits a receiving API binding and integration review. The service authorizes each exposed field and identifier. Human-readable text stays useful at the receiving disclosure level. Logs and correlation data have their own protected route.
4 · Focus, announcements, and preserved work
A form’s summary links to the precise affected controls. Move focus to the summary when a submitted action needs a coherent repair path; a single local field correction can retain position. aria-describedby joins persistent help and the relevant issue; aria-invalid reflects the applicable validation result. Announce meaningful changes once at their fitting urgency. Keep ordinary pending updates calm; one meaningful state change receives one fitting announcement.
A docked inspector participates in normal document navigation. A modal acquires a named focus scope, makes the background appropriately inert, offers its stated dismissal policy, and returns focus to its surviving invoker or a stable fallback. A native dialog supplies useful browser semantics; nested dialogs, portals, virtualization, and route changes still need their own integration checks.[2]
Preserve valid values through repair and request failure. Bind draft persistence to sensitivity, audience, and expiry: browser memory, an authorized local store, or a service draft. A component unmount is a lifecycle event; the product explicitly chooses which draft survives it and which audience can later retrieve it.
5 · Acquire, release, and re-entry
Resource | Acquire boundary | Release boundary | Review surface |
Event listener | Component/controller mount | Abort-bound listener cleanup or matching removal | Remount produces one response per event |
Timer / animation frame | Active operation | Completion, replacement, or teardown | Released work leaves the active registry |
Subscription / store | Owner attaches | Returned unsubscribe or owner disposal | Delivery targets the active owner only |
Resize / intersection observer | Observed region appears | disconnect() or explicit target removal | Observation owner disconnects after region removal |
Fetch / stream | A specific read or operation starts | Cancel, close, or completion | Result applies only to the eligible identity and revision |
Object URL / worker | Artifact or worker acquired | Revoke / terminate on final owner release | Pooling or sharing has an explicit reference owner |
WebGL / canvas resources | View or shared renderer acquired | Named resource disposal / renderer release | Memory and device-loss recovery measured locally |
Server connection / session | Bounded service operation | Context exit, commit/rollback, pool return | All terminal paths release ownership |
The The Acquire-Release Spine — Resource Lifetime Across Seven Layers supplies the cross-layer discipline: identify the acquired resource, its scope, and every release path. Concrete APIs differ by resource and runtime.[3]
A small vanilla controller can own a lifetime explicitly:
This illustrative seam assumes the referenced callbacks and model exist. A real controller declares idempotent disposal, shared-resource policy, ownership replacement, and which asynchronous work is eligible to publish. A read-generation identifier plus cancellation can keep an older response from replacing the current selection. A cancelled client wait leaves a separately committed service operation governed by its receipt.[4]
6 · Framework bindings
React. Effects own concrete resources and return their cleanup. Dependencies define replacement scope. Development Strict Mode’s setup/cleanup replay is a useful lifecycle stress condition. Keep component instance identity, selected entity identity, read generation, and durable operation identity distinct. Error boundaries cover their documented rendering/lifecycle scope; request and event outcomes need explicit workflow handling.[5]
State and server data. External-store snapshots remain immutable and coherent within a committed view. Server data keys include the representation dimensions that affect the result; freshness, retention, optimistic draft, and durable command standing have distinct meanings. A stale display names its revision and refresh route.[6][7]
Next.js. Declare the actual framework version and router. Server/client component boundaries determine where code runs and which values are serialized. Hydration needs coherent initial identity, values, and token binding. Cache, streaming, revalidation, and client request rules follow the named target version and local configuration.[8]
Django / FastAPI. The response DTO is an authorized projection. Query strategy and transaction scope are deliberate. Match synchronous and asynchronous work to the handler/driver boundary; measure resource pressure under the actual workload.[9]
These are selected adapters from the existing Registry corpus. Selection is based on their available ownership guidance. A statistical popularity assessment would require its own evidence.
7 · Scale through measured budgets
Choose budgets for the receiving task and devices: visible-result latency, keyboard response, initial transfer, parse and render work, DOM/SVG node counts, main-thread long tasks, retained memory, query cost, response size, and service concurrency. Record workload, device/runtime, representative data shape, sample count, distribution, and measurement method. Percentile claims require a fitting measured population.
Virtualize a large list only with a declared focus and accessibility strategy: stable record keys, useful result counts, accurate visible range, keyboard continuity, and an accessible query or table route. A retained selection may outlive the current rendered window. Server pagination and projection reduce data acquisition; DOM virtualization addresses only the rendered region. Aggregation, progressive detail, Canvas, or WebGL change representation and resource ownership, so preserve the source and text companion needed for interpretation.
Cache keys include the fitting authorization and representation scope. Eligibility and freshness checks apply at delivery as well as acquisition. Revalidate a changed entitlement or audience. Caching, Consistency & Invalidation — Middleware Vanilla Practitioner Probes supplies the coherence and invalidation substrate.[10]
8 · AI and disclosure boundaries
An AI-facing representation exposes the minimum useful state: task, selected authorized entity, current revision, permitted operations, structured issue codes, and bounded evidence. The service evaluates the caller and action; visual emphasis makes an action legible, while the trusted service establishes authorization. Values, timing, topology, cross-links, identifiers, and retained history can each carry disclosure consequences.[11][12]
Use Visual Fidelity with AI — Bounded Callers, Disclosure & Recovery Probes for approval scope, prompt-injection boundaries, generated-specification claim standing, calm recovery, and human workload. The art-direction pages remain focused on visual character.
9 · A proportionate verification ladder
Check | It establishes | Additional evidence belongs with |
Token/composite calculation | The specified foreground/background pair | Actual states, focus adjacency, image content, device treatment |
Syntax / schema validation | The checked syntax, shape, and declared constraints | Semantic fit, source truth, authorization, behavior |
Local browser fixture | The exercised behavior in that fixture/runtime | Assistive technology, cross-browser behavior, real data and services |
Fault-oriented component test | The named plausible fault and observable oracle | Other failure geometries and integration boundaries |
Service integration / contract test | The exercised authorized representation and operation | Load, recovery, migration, incident behavior |
Receiving deployment review | The documented release scope and evidence | Later workload, audience, version, and policy changes |
The four attached libraries passed 32 view checks at 1280 and 390 CSS px, with six interaction groups on the Soft Color Blocking fixture: route filtering, linked repair and draft retention, modal focus/return, controller replacement, observation scenarios, commerce intent and released-controller re-entry. The run observed zero external HTTP requests and zero script exceptions. These are bounded local receipts; keyboard/assistive-technology, security, service integration, and load claims keep their fitting receiving-system checks.
Pattern-library local QA receipt
Verification follows the claim and material result. Goal Fidelity Under Partial Context — Proportionate Structure, Material Evidence & Calm Recovery grounds the separation between useful tests and proxy counts; it also supports localized repair and a clear completion horizon.[13]
10 · Delivery and release record
A release is complete when its requested result is usable, its declared checks are satisfied or visibly bounded, and remaining ownership is clear. Re-enter for a changed state meaning, service contract, audience, source revision, framework version, or measured workload. A calm failure route preserves the useful work and selects one stabilizing next move.[14]
Navigation
Visual Fidelity Contracts · Visual Fidelity Practitioner Probes — Layered Judgment & Evidence
Machine Node
© 2026 Vikrant Varun Kudesia · Driftframe Studios, LLC