plan: SHIP Phase 3 — PLAN.md, gate riders, G4 archive moves

BACKLOG.md

@@ -14,17 +14,17 @@ check. Nothing found was dropped. **Scope key** — the column the gate decides:
 
 | ID | Item | Source/evidence | Status | Pri | Acceptance criteria |
 |---|---|---|---|---|---|
-| D1 | Receipt/verdict component system (the signature): shared visual language for checker verdicts, catalog verification badges, Studio policy gate, enforcement page | DESIGN §1; audit P1-4 | absent | P1 | One shared component/token set renders clean/blocked/chain verdicts; used by ≥4 surfaces; axe clean |
+| D1 | Receipt/verdict component system (the signature): shared visual language for checker verdicts, catalog verification badges, Studio policy gate, enforcement page | DESIGN §1; audit P1-4 | absent | P1 | One shared component/token set renders clean/blocked/chain verdicts; used by ≥4 surfaces; axe clean; **status never encoded by color alone (WCAG 1.4.1 — icon + word + color; reads correct in grayscale)** [SHIP-GATE-R2 rider] |
 | D2 | Checker verdict redesign + island i18n (fixes P0-2/P0-3) | `PolicyChecker.svelte` | broken i18n | **P0** | Island honors `lang` (house STR pattern, es/ar shipped); verdict = receipt band; CLI jargon behind a disclosure; localized empty/error states |
-| D3 | Catalog explorer density redesign: responsive 1→2→3-col receipt cards, designed facets w/ counts, `accent-color`, designed zero-result/empty/error states at full 1,359-entry dataset; locale-aware CTA (`:358`) | audit P1-3, P1-8 | default-ish | P1 | Desktop page no longer a 20k-px column; facets on-token; all states designed; CTA locale-aware |
+| D3 | Catalog explorer density redesign: responsive 1→2→3-col receipt cards, designed facets w/ counts, `accent-color`, designed zero-result/empty/error states at the full dataset (count = the E6 generated figure, never a literal) [SHIP-GATE-R2 rider]; locale-aware CTA (`:358`) | audit P1-3, P1-8 | default-ish | P1 | Desktop page no longer a 20k-px column; facets on-token; all states designed at the full dataset; CTA locale-aware |
 | D4 | Token-only island rule: retire `--sl-*`/raw-hex/off-scale rems from BuildStudio, CostEstimator, ModelCompass, CatalogExplorer; add `--shadow-1`, verdict washes, global `accent-color` | audit P1-5 | split dialects | P1 | grep: zero `--sl-color` refs in island styles; zero raw hex; `/build/models/` axe color-contrast = 0 (closes the 89-node finding) |
 | D5 | Landing: replace stock CardGrid/LinkCard sections with bespoke WorkOrderGrid; copy-register pass | `index.mdx:37-99`; audit P1-1, P1-7 | stock | P1 | No Starlight Card/LinkCard on the landing; copy passes the register rules (§4) |
 | D6 | Footer override (last stock chrome) | audit P1-2 | stock | P1 | Designed, token-native, locale-aware footer on all pages |
 | D7 | Copy-register pass on /build /check /build/models /start intros + island empty/error states (en/es/ar together) | audit P1-7 | jargon | P1 | Register rules met; es/ar land in the same commit as en |
 | D8 | `TODO: confirm` → designed provenance chip ("unverified — awaiting human check"), same semantics | audit P1-6 | placeholder register | P1 | No user-visible "TODO"; zero-fabrication semantics preserved; localized |
 | D9 | BuildStudio stray strings → STR table; AccountWidget ar placeholder; data-layer prose i18n keys (compass cautions, estimator labels) | audit P1-8 | strays | P1 | grep finds no hardcoded user-facing English in islands with i18n tables |
 | D10 | `/console/` joins the token layer (raw hex → tokens, `.btn`/`.field`); stays standalone-CSP, stays English (documented operator exception) | audit P1-10 | off-system | P1 | Zero raw hex in console surfaces; CSP wss: rule unchanged (invariance test stays green) |
-| D11 | Arabic display face: self-hosted subset OFL face (Readex Pro candidate) wired via `:lang(ar)` | audit P1-11; DESIGN §2/§7 | absent | P1 | ≤45 KB woff2, OFL license committed, `/ar/` headings render the face; perf budgets hold |
+| D11 | Arabic display face: self-hosted subset OFL face (Readex Pro candidate) wired via `:lang(ar)` | audit P1-11; DESIGN §2/§7 | absent | P1 | Final face pick + measured subset size recorded as a PLAN.md checkpoint BEFORE implementation [SHIP-GATE-R2 rider]; ≤45 KB woff2, OFL license committed, `/ar/` headings render the face; perf budgets hold |
 | D12 | Hydration pass: `client:visible` for below-fold islands; ModelCompass considered for static render + filter-only island | audit P1-9 | all-eager | P1 | No LCP regression on /catalog/; JS transferred on /build/models/ drops; e2e stays green |
 | D13 | Page-weight ceilings recorded + measured (reading ≤250 KB, tool ≤450 KB, landing ≤350 KB) | DESIGN §8 | new | P2 | Measured per page type in VERIFICATION.md; over-ceiling pages fixed |
 

DESIGN.md

@@ -23,8 +23,10 @@ surfaces are the product's thesis, so that is exactly backwards.
 (clean / blocked / chain-to-excluded), the Studio's policy gate, the
 enforcement page's verdict band, admin audit views. A receipt is: a stamped
 edge (2px structural rule), a status color that is never decorative
-(`--ok/--warn/--danger`), the evidence inline (commit SHA, org chain, license
-id), and a plain-verb sentence a non-developer can act on. Boldness is spent
+(`--ok/--warn/--danger`) **and never the only carrier — icon + word + color,
+correct in grayscale (WCAG 1.4.1; SHIP-GATE-R2 rider)** — the evidence inline
+(commit SHA, org chain, license id), and a plain-verb sentence a non-developer
+can act on. Boldness is spent
 here — the blocked-dependency moment should feel like a customs stamp coming
 down — and everywhere else stays quiet: paper, ink, structure.