some more fixes

simplify/guidelines/design-language.md

@@ -0,0 +1,54 @@
+# Design language
+
+One hand made all four apps and they should look like it. Warm paper palette, Hanken Grotesk for UI,
+Literata for headings, `data-theme` light and dark, hand-written CSS on a shared token set, no CSS
+framework and no component library.
+
+The tokens, the six bundled faces and the title bar glyph paths are the parts the apps must agree on
+and they live in `margin-shared`. A glyph is a design decision, not a detail: when each app drew its
+own search icon they drifted, and the result was two products from the same hand that did not look
+related.
+
+## Keyboard first
+
+Every app is driven from the keyboard. Single keys, not chords, following the vocabulary the user
+already knows from the products in that category. Margin Mail takes Gmail's and Superhuman's single
+keys plus HEY's verbs.
+
+Navigation steps by the smallest useful unit. In Margin Calendar the arrows and `h`/`l` move one day,
+never a whole week, because a week jump destroys positional memory and positional memory is most of
+the speed of a keyboard-driven app. The user's words for the week jump were that they "absolutely
+hate" it.
+
+## No third-party marks
+
+No provider logos anywhere. No Google button. If a flow needs to know which provider a user is on,
+infer it rather than asking them to pick a brand.
+
+## Ask for the identifier, not the category
+
+The add-account flow is address first. One email field, and the app reads the domain and routes:
+Gmail domains go to browser sign-in with a `login_hint`, Microsoft hosts get an honest "not here
+yet", everything else gets a sign-in step that names the servers it discovered before asking for a
+password. This is the shape Thunderbird's Account Hub, Spark and the new Outlook use.
+
+A fork that asks people to classify their own mailbox makes them answer a question before they know
+what the answers cost. A big Google button beside a small "other" button reads as a Gmail client.
+The user rejected that layout twice.
+
+## A permission gate is a state, not an error message
+
+When the OS gates a feature, the section shows one plain line for the state and one button that
+fixes it, either asking for permission or opening the system's own pane. Every control that depends
+on the permission is disabled until the answer is yes. State first, controls second.
+
+What this is not: an error sentence sitting under live controls, a second button beside the first, or
+copy that blames a named operating system. That is a puzzle rather than a state, and it is what
+every other app already gets right.
+
+## Restraint
+
+No AI features unless the design was drawn with them in it. No settings for decisions the app should
+make. Two font slots, body and heading, because a document that lets its author pick a face per
+paragraph is a word processor, and none of these is one. Scale, leading and measure belong to the
+stylesheet, which decided them once for every document.