design:os Figma plugin

A · the design system

One file, ten apps

The curated registry describing all of it is deliberately thin. It calls itself a decision file, not a catalog: counts, ids and variants are generated into a separate inventory file straight from the canvas, and the curated file holds only owner rulings, reasons and bans.

A lint enforces that split, and regeneration is cheap enough that the rule is to regenerate unconditionally at the start and end of every build wave rather than track staleness.

Scanned in 13.1 seconds

The 2026-09-15 scan that produced every count above read the whole Design system page in 13.1 seconds.

Regenerate, never track

Regeneration takes about 9 seconds for the whole file, so it runs unconditionally at the start and end of every wave, with no staleness threshold to get wrong.

Capped at 300 lines

The curated file is blocked from growing past 300 lines, and from ever containing a node id, a date heading, or a hand-typed count.

B · context and the ledger

The file carries its own context

The file documents itself from the inside, and decisions live the same way: one append-only file per app, every row coded and dated.

A correction never promotes itself into knowledge either. A designer's live edit is logged and quarantined, not auto-applied as a new rule, until the project's own governance gate promotes it.

READ ME FIRST

A frame in its own Start Here section: a read-first list, a map of where every section lives, the canonical templates to copy from, and a digest of the file's hard rules, all readable without leaving Figma.

Struck through, never rewritten

One row in the PCP ledger, coded W2-PCP-2, still carries its original text struck through, followed by a note that a BA comment flipped it on 2026-09-08.

Context compressed to 0.1744

Outside Figma, a .brv context tree condenses small memory notes into dated summary nodes: one measured example took 8 source files and 3933 tokens down to 686.

FACT, INFERENCE, ASSUMPTION, UNKNOWN

Before any mutating action the working discipline is that same four-way ledger.

C · a request arrives

Classify, then climb the ladder

No single document narrates this reasoning: it is reconstructed from the file's operating gates and real comment-thread resolutions.

One trace shows the ladder working end to end. A comment asking that add-ons render as chips rather than a plus-sign string was traced to a new table-cell variant, Type is TwoLine plus Tags, and a new chips slot on the existing composite Fact row. Both changes were logged against the comment id, not just the screen.

Classify first

DEFECT means fix the master, MISSING TYPE means extend the family with a new variant, and DIFFERENT NATURE is rare: a genuinely different composition that has to be proven. A per-screen one-off is never an acceptable fourth option.

Then climb the ladder

Reuse an existing component, override an instance, add a variant, and only as a last resort create a new one, which for a shared master needs owner approval.

users: 0 is not deletable

A usage query that failed to run must be recorded as unknown, because collapsing a failed query to zero risks deleting a component the owner is deliberately keeping.

Composites count too

A frame named like a component but never typed as an instance is a reuse violation on its own.

Changed back twice is intent

A value the owner changes back twice after it was set is read as owner intent: stop fixing it, check the decision ledger, ask once, and lock the ledger.

D · a PRD arrives

Scope in and out, then shell plus slot

The file's clearest PRD-driven build treats its source PRD as literal: a single Markdown file at the client repository's root, cross-checked against a Vietnamese prototype the file itself calls a BO concept demo, not a spec. That prototype survives only as reference: 73 of its screenshots are kept on canvas as dated Ref frames for traceability, never as the thing actually built.

Scope is split before anything is drawn. The PRD's own section names an overview and a golden-paths catalog as in, and puts global search, an AI assistant, the Compliance Profile and Matrix, recall and cancel, in-app approval, a role toggle and every database add-on but Aurora PostgreSQL out.

50 artboards, 19 masters

The first wave under this discipline shipped that count, dated 2026-09-12.

A page is never one component

Every screen is the shared shell with one page-specific master dropped into its slot, which is what makes a shell change reach every screen at once.

Two operations, every screen

1. Instance the shared Shell / Template component.

2. Swap its Slot / Page content to a screen-specific master.

D2 · anatomy of one screen

Anatomy of one screen: the layer tree

A read-only capture of one real production screen, Shell · service-advanced on the V-Builder page, taken with the plugin's own exec-js against the live node. It makes section D concrete: the root is itself an instance of Shell / Template / Scope=Organization at 1920 by 1260, and drawing it really was an instance plus one slot swap, not a page built from scratch.

Every repeating leaf is a named master, never a raw shape: the sidebar's app entries, the ten apps plus Setup Workspace, are eleven instances of NavItem, one State=active and the rest State=default. Nothing sits at an absolute position; every frame and instance declares its own auto-layout mode and its own sizing on each axis.

• INSTANCE Shell · service-advanced · master Shell / Template / Scope=Organization · layoutMode HORIZONTAL · sizing FIXED/FIXED · 1920×1260
  • INSTANCE Sidebar · master Sidebar / IDP / Mode=Collapsed · layoutMode VERTICAL · sizing FIXED/FILL · 76 wide
    • INSTANCE NavItem × 11 (State=default × 10, State=active × 1) · master NavItem, one variant per app plus Setup Workspace
  • FRAME Content · layoutMode VERTICAL · sizing FILL/FILL
    • INSTANCE Top bar · master Top bar / Scope=Organization · layoutMode HORIZONTAL · sizing FILL/FIXED
    • FRAME Body · layoutMode HORIZONTAL · sizing FILL/FILL
      • INSTANCE Sub-sidebar / V-Builder · master Sub-sidebar / V-Builder / Active=Golden paths · layoutMode VERTICAL · sizing FIXED/FILL · 260 wide
      • INSTANCE Page content / VB · wizard-service-advanced · master Page content / VB · wizard-service-advanced · layoutMode VERTICAL · sizing FILL/HUG · 1584 wide

E · componentize

Normalize first, extract on the third repeat

Turning a repeated pattern into a real component is gated, not casual, because construction debt multiplies through every future instance.

The master itself is always lifted from a live instance, never a stale one: the live instance carries the overrides the owner actually approved.

Lint before minting

Zero spacer frames, zero 1px fillers, spacing only through auto layout.

Extract on the third repeat

A pattern built inline the first two times is normal, and only earns its own component on the third.

Lift from a live instance

Clone it off canvas, detach it twice (the shell, then its content), then build the component from that clone.

89 nested cards to 0

A full-v2 cleanup wave on 2026-09-16 flattened card-in-card construction debt across 21 masters, by promoting the repeated pattern into first-class table and column components instead of leaving copies inline.

Pin, then fill

After combining masters into variants their FILL widths collapse to about half. Pin every variant to a fixed width matching the slot, then set the slot itself back to FILL.

F · nested components

Column-first tables, frozen geometry, variant matrices

The file's deepest, most repeated nested pattern is the column-first table. Alignment follows from its construction rather than from a row-by-row check: a head and its cells share one column frame, so they cannot drift apart.

The most expensive lesson paid for in this pattern is that geometry inside an already deployed instance is frozen.

Column-first table

A table card holds a horizontal row of columns; each column is a vertical stack with one fixed width and one fill, carrying its own head and N cell instances.

Frozen inside an instance

resize, setProperties and swapComponent on a node inside a live instance all silently no-op, so a chart whose bars vary by data point bakes each dataset as its own variant on the master. Applied to the LLM Gateway chart components across rounds 14 to 15, dated 2026-09-12.

Matrix caps

Building a variant matrix mechanically is a cartesian product of axes, hard-capped at 100 combinations, with a size warning above 40.

Slots are not nesting

Figma's own Slots, generally available since June 2026, let a component expose a named hole an instance fills with its own content, separate from swapping a nested instance.

G · gates

Four layers between a mistake and the owner

The system tracks one health metric: defects the owner had to catch personally. Four catch layers stand in the way, in order: the machine gates, the agent's own three-layer self-verify, a separate curator layer that samples PNGs by eye, and the owner, who is meant to catch nothing twice.

That last machine layer exists because four real incidents on this file passed every numeric assert and were caught only by eye, including a script that ran blind past a top-level const and still reported success, and a PNG that looked aligned while hiding a bug that quietly drifted every row.

Three layers, in order

Node-read asserts, re-checked in a fresh call for any structural change because a same-call re-fetch can lie; then numeric geometry asserts for overlap, collapse and drift no larger than half a pixel; then a freshly rendered PNG read by a human eye.

An empty check set throws

A gate must throw rather than silently pass when its own filtered check set is empty: a filter that matches nothing and still reports a pass is a false green in its own right.

Audit gate G7

One named example, a sizing contract on the file's drawers: a drawer instance's height must equal its artboard's height, and its body must fill vertically inside the shell.

Assert, then capture

The plugin's own export-png folds a structural check and the capture into one call. It runs the assert script read-only first and writes the PNG only if that assert passes, so a file on disk always means the structural check held.

When a defect still reaches the owner

1. Fix the defect on canvas.

2. Extend an existing gate, or add a new one.

3. Add a negative test that proves the new gate fails on that exact defect.

4. Log a changelog entry and bump the gate suite's own version.

H · a campaign day

One day, timed

The most granular timed log in the file is a single knowledge-graph campaign day, 2026-09-07, drawn below on its own clock.

Nothing in that run was estimated after the fact. Every row is a timestamp from the campaign's own plan file, and so are the two figures that bracket it: the estimate going in, and the acceptance at the end.

Wave 2, into the next day

A follow-on deep dive ran past midnight and finished 2026-09-08 at 01:45: 106 of 106 batches ok, 460 screens, and 573 raw questions distilled down to 56 owner-answered decisions.

Lineage

The underlying skill dates its rules to real incidents across the 2026-06 to 2026-08 campaigns, consolidated into a reusable skill on 2026-08-07 and extended into v1.1.0 on 2026-09-03.