Press an entity and get five facts and one action, without going anywhere. It is drawn first because it is the hardest density in the product, because every later surface inherits its decisions about which five facts matter, and because it is where permission-scoping first becomes visible — so it is where we decide what scoped looks like, as opposed to broken.
Fixed width. Exactly five fact rows. One of them may be big. One action. Nothing on the card is a link.
If a new entity needs a new card, this is not a surface type — it is a page written twice.
A cafe table breaks the clock rule on purpose. It is billed by order, not by time, so its big number carries EGP and can never be misread as minutes. Money stays paper-toned, because money is not live — it is as-of.
Nothing has entered the till. The cash ledger has no row for this visit yet.
Three seats, one number. She started at a cafe table, moved to PC-03, then to PC-07, and was never asked to settle anything in order to move.
No big row. Nothing about a customer at rest is a countdown, so nothing earns the size. A card that makes something big because the slot exists is data slop.
Rana ordered, Hossam's visit carries it. She joined his party by scanning his code, so the line is attributed to her and the tab is his until they split.
The drawer figure is the ledger's own running balance. It is not re-added here. If this card recomputed it, the card and the close sheet could disagree and nobody would know which one is the drawer.
Owner's view. The counter's version of this same card is below, and it is the most important pair on this page.
The same entity, seen by two roles. This is the pair the whole surface was drawn first to settle.
Receiving stock changes capital, so it is the owner's or the technician's. Ask either of them and it takes a minute.
A withheld row keeps its position and its label. It does not vanish, and the rows around it do not close up. Somebody who has seen the owner's card and then sees this one is looking at the same card with three values replaced — not a different, emptier card that might be broken.
The chip names the holder, not the prohibition. "Owner only" says who can answer; "Restricted" says only that you cannot, which sends the counter to find a person rather than a role.
The note affirms what is shown is whole. This is the sentence that does the work. A scoped figure with nothing said about it reads as the truth, and that is precisely the difference between a scoped view and a broken one.
Never a spinner and never a blur. Both make a scoped card look like a card that is still loading, and a counter who waits for a number that is never coming stops trusting the screen.
Drawn here at peek scale. U3 lifts them into the system so every surface uses the same four.
Disabled because the server has not answered yet — not because we guessed.
The card keeps its shape. Name, labels, row count and row positions are all present before any value arrives, so the eye lands where it will land. Only the facts are missing, and the bars sit exactly where the facts will be.
The floor changed after this card was drawn. PC-03 may already be free, or may have been taken forty seconds ago.
A stopped watch, not a blank face. Every number holds its last value, the clock loses its live tone, the age counts up in the chip, and the action goes off. A stale card that looks live is a wrong card that looks right.
Could not read this machine.
The floor service did not answer. Any session on PC-05 is still running and still billing on the server — this card just cannot see it. Nothing has been lost.
Last attempt 21:04:12 · retrying by itself every 10s
Legible from across the room. A coloured top rule and a filled panel, because the rule it exists to satisfy is that an error must be distinguishable from an empty set at a glance, from a distance. Both sibling products shipped with no error state at all and rendered failures as empty lists.
No agent has ever reported from this machine. That is normal before one is installed — the registry comes first — so the card claims nothing about the hardware.
Empty is quiet. No coloured edge, no rule, no alarm, and it offers the thing that would fill it. That is what keeps it from reading as the error above.
| # | Rule | Why it is here and not somewhere else |
|---|---|---|
P1 | Exactly five fact rows. | A sixth row is a record pane asking to be opened. The budget is what forces the argument about which facts matter. |
P2 | One row may be big, and only if something is genuinely counting or owed. | A card that makes something big because the slot exists is data slop. A customer at rest has no big row. |
P3 | The big number takes its state tone, never the accent. | The accent is not a state in this vertical. A live card gets the spill behind it instead. |
P4 | The action is charcoal-or-white, never accent-filled. | The accent is never behind a button. The moment a primary button turns cyan, every running tile on the floor starts looking pressable. |
P5 | Nothing on the card is a link. | It may act; it may not navigate. Navigating away is how an operator loses half-built work. |
P6 | Any money figure names its ledger and its as-of time, in the foot. | A figure with no stated source and no as-of will be cached and shown as live. |
P7 | A withheld row keeps its position and label, names the holder, and the card says the rest is complete. | This is the whole difference between scoped and broken. |
P8 | A disabled action states why, in words, under itself. | Never a bare grey button and never a toast for a rule. |
P9 | A live dot appears only when something is actually live. | Normal is silent. A card that decorates every healthy entity is a card you stop reading. |
The capability map — every capability from the
briefs, the control that exposes it, and when it is disabled — is in
handoffs/customer-and-money/1-ui.md. A capability with no control is not shipped,
and that document is where the claim gets checked.