Pure pipelines. Injected world. Checkable output.

• 1. The Tribunal is injected, not imported. studio-core cannot depend on tribunal (cycle, and purity), so pipelines ask for grades through a GradePort and the server hands them the real engine — repair loop and all. Tests hand them fakes. Same pipeline, both worlds.
• 2. Deterministic checks outrank the model. A hard failure cannot be argued away by a high score. This ordering is why our own marketing copy failed its own grading — and why that story is credible.
• 3. Degrade honestly, never silently. Every provider call can fail without aborting a pack; the failure becomes a recorded coverage gap. During a real OpenAI billing outage the pipelines kept delivering — smaller, disclosed, true.
• 4. No facilitator in payments. The gate verifies EIP-3009 signatures itself and settles with its own gas key. Fewer moving parts, no third party to trust, and refunds-by-construction: a failed settlement releases the nonce.
• 5. Hash-only chain. The contract stores 32-byte leaves and timestamps. Nothing personal, nothing revocable, nothing to leak — and verification works from public data alone.

The product has one editorial system and two light conditions. Amethyst Daylight uses warm ivory paper, ink typography and restrained reflected amethyst. Amethyst Nocturne keeps the same hierarchy on an aubergine ground, brightens grade colors to WCAG AA, and lets seals, active states and primary actions emit a soft bloom. The setting defaults to the operating-system preference, is applied before first paint, and persists locally.

Texture is code, not downloadable decoration: a fixed inline-SVG turbulence layer reads as paper grain (multiply in Daylight, screen in Nocturne); parametric guilloché rosettes and certificate borders mark provenance moments; warm radial vignettes give section heads depth without sitting behind body copy. All motion collapses underprefers-reduced-motion, while Open Graph images remain theme-stable so a shared pack never changes identity with the viewer's preference.

There is deliberately no WebGL hero object. The visual budget belongs to the product flow: route sheets arrive, sections reveal in editorial sequence, the real Studio feed follows work between roles, failed artifacts return for repair, finished artifacts settle into the pack, and the seal press lands with weight. Removing the decorative scene also removes a separate loading, GPU and fallback state from the first impression.

Motion explains state: grades count up once, a failed artifact visibly returns for repair, active roles pulse, finished cards settle, and the seal's guilloché turns during the press. The recent-seals ribbon is populated from anonymized public store data, never invented activity. Sound follows the same restraint: persisted, default off, and never fetched at all until you ask for it — one opt-in gates both a soft seal foley and a quiet looping room tone, and a remembered preference still waits for a real gesture rather than starting on its own.