Filtered to Area G

Every surface that shows pairing material, an invitation's sign-in address, join link or decline address, the front door address, a device hand-off's address or one of its clients' codes, or a minted key's secret MUST offer each as a QR code beside its text, drawn on that surface from the text exactly as the stack gave it.

A member's surface MUST NOT show a service's name, a domain term, a size, a rate, an address, a version, a stage of the pipeline, or how the stack stands, and MUST say what it says in household words, leading with what the member can do. Where it names the stack it MUST call it the house. A member's surface is any screen drawn for a household member's session on any surface, any notification sent to a member, and any text lemonfiber places where the household asks for things.

Every refusal and every obstacle the core answers to a household member's session MUST carry a sentence written for the household, and a remedy the member can act on, beside its code (ARCH-R138). The sentence MUST name no service, size, address or state of the stack (G2-R16), and a fault of the stack MUST read as not working right now with the operator told (N3-R10).

A plugin's declared reach MUST be refusable on its own, the consequence MUST be stated as what stops working, and a refused reach MUST be reported as nothing having been asked rather than as a failure of the destination.

Where an install or update of a third-party plugin names a credential of another service that would cross to it, the console's reading MUST show each one with the setting it is held under, the service whose credential it is and the capability of the plugin's own it is for, and never its value. The operator MUST approve each one apart from the offer, on a switch of its own that is off until turned on; agreeing to the offer MUST approve none of them, and the yes MUST carry each approved one exactly as the reading names it (ARCH-R323, F14-R20). Every update MUST ask again, and a grant the plugin already holds MUST NOT be taken as approved. Where the stack refuses the act for a grant left off, the refusal MUST be drawn in the stack's words.

The console MUST list, for each installed plugin, the grants it holds, each with the setting the credential is held under, the service whose credential it is, the capability it fills and when it was approved, and never a value (ARCH-R323).

The console MUST offer revoking each grant a plugin holds. The revoke MUST be read first, labelled as nothing ended yet, showing the grant it ends and the plugin's services it would restart; the yes MUST carry back the offer the stack named (ARCH-R324). Afterwards the console MUST show whether the grant was ended, the services that restarted and, where they did not, the stack's reason, and MUST say that the plugin stays installed and that rotating the credential is what takes back a value already handed (ARCH-R324).

A plugin's grants, and revoking them, MUST be shown to the operator alone and MUST NOT appear anywhere a member is shown (G10-R9).

The console's credentials panel MUST list every grant beside the credential it crosses, with the plugin it is granted to, the capability it is for and when it was approved, and never a value (ARCH-R325, F14-R20).

The names lemonfiber gives its own things — the words that also name a file, a command or an argument — MUST be declared, and every locale MUST render a declared name as declared and translate only the text around it.

A member MUST be able to see their own requests, ask for something, see what the household holds, and play it.

Where the media server cannot be reached, playback MUST be declined with the reason, and MUST NOT be queued or shown as buffering.

The player MUST NOT implement request, approval or allowance logic of its own.

Where the household reaches a service that faces them, the surface MUST be able to hand them its address, whether or not that service is the front door.

Where a service a member is handed to cannot be reached from where they are, the surface MUST say so, and MUST NOT present an address it knows will not answer.

On every surface, the label of a control, a tab, a menu item or a section heading MUST name what it opens or does in at most three words and MUST NOT be a sentence; a sentence MAY explain beside it, and a name declared under G2-R14 counts as one word.