docs(handoff): design conversion complete; spacing is a layout pass

HANDOFF.md

@@ -1,33 +1,32 @@
-# HANDOFF — 2026-10-30 (design standard + token sweep complete; visual check pending)
+# HANDOFF — 2026-10-30 (design conversion complete; spacing is a layout pass, not a sweep)
 
 ## State
 
-- Branch `main`, worktree clean. **Twelve commits, unpushed** (push at your checkpoint),
-  `565b8db` → `c885bbd`. `DESIGN.md` is normative; `Themes/Tokens.xaml` implements it.
-- **Every XAML surface is tokenised and guarded**: theme, window, top bar, scene strip, left
-  panel, preview pane, App Settings, and all nine dialogs. The guard lists them all, so a raw hex
-  in any of those files fails `DesignTokensTests`.
-- Blue `#38bdf8` is the only interactive accent; red `#ff5451` is live/record; `positive`
-  `#22c55e` is status only; `attention` `#ff8c3a` is warnings; `#e94560` is retired from chrome.
-- Two duplications were killed on the way: the scene tiles no longer use one colour for two
-  states, and the webcam's right-click border-colour menu is generated from
-  `Models/BorderColorPalette` instead of carrying its own seven colours.
+- Branch `main`, worktree clean. **~20 commits, unpushed** (push at your checkpoint).
+- **The design conversion is done**: `DESIGN.md` is the contract, `Themes/Tokens.xaml` implements
+  it, and every surface consumes it — UI chrome, all dialogs (typeface included), the VM's state
+  colours via `Helpers/ThemeBrush`, and the on-stream graphics via `Services/Compositor/OutputPalette`
+  (which mirrors the tokens and is checked against them, because the pump thread cannot read app
+  resources). Blue `#38bdf8` is the only interactive accent; red `#ff5451` is live/record;
+  `#e94560` is gone from the product.
+- Four guards hold it: `DesignTokensTests` (doc ↔ brushes; converted files may not regress to a
+  literal), `ThemeResourceTests` (no dangling `StaticResource` — the class of crash that killed the
+  app on a slider), `OutputPaletteTests` (on-stream ↔ theme), `SocialsPreviewTests` (a real
+  MainWindow, real preview elements) and `DialogTypographyTests` (dialogs inherit Inter).
 
 ## Next action
 
-**Tokenise the VM-side state colours** (the last raw hexes in app chrome). They are strings bound
-to `Background`/`Foreground`, so this is a VM→`Brush` refactor, not a find/replace:
-`MainViewModel.Streaming.cs` (`RecDotBrush`, `RecTextBrush`, `OnAirBrush`, `RunningDotBrush`,
-`TopBarBackground`), `MainViewModel.Streaming.Operations.cs` (`HealthIssueBackground`,
-`PreviewGlowBrush`), `MainViewModel.Audio.cs` (meter zones, `MicProblemBrush`),
-`Services/NotificationService.cs` (toast tints). Values already match the standard; only the
-literals remain.
+Nothing queued for the design. The **one** item deliberately not swept: the spacing scale. Margins
+and paddings are per-side `Thickness`, not the single values `DESIGN.md` defines, so converting
+them mechanically would change layout without a rationale — that is a layout pass (a designer's
+job), not a colour-style sweep. Radii are tokenised where a token was honest; component geometry
+(pill halves, 2.5px hairlines) stays literal on purpose.
 
 ## Landmines
 
-- **Not every hex is a theme colour.** Leave `BorderColorPalette`, picker `Tag=` values,
-  `Models/Source.cs` chat defaults, and the on-stream renderers (`AlertRenderer`,
-  `ChatBoxRenderer`, `Compositor/*`, `BrandFlashPresenter`) literal.
+- **Not every hex is a theme colour.** `BorderColorPalette` and the chat/socials config defaults
+  are USER DATA — they keep their literals. On-stream graphics now come from `OutputPalette`,
+  never from a literal or from app resources (the pump thread must not touch them).
 - A red settings control is a bug now — red means live/record.
 - Pre-existing: the **full test suite hangs** (WASAPI teardown). Per-class runs are the way.