diff --git a/.planning/phases/01-stabilize-video-pipeline/01-12-RESEARCH.md b/.planning/phases/01-stabilize-video-pipeline/01-12-RESEARCH.md
new file mode 100644
index 0000000..eaef5da
--- /dev/null
+++ b/.planning/phases/01-stabilize-video-pipeline/01-12-RESEARCH.md
@@ -0,0 +1,1309 @@
+# Plan 01-12 (Design Integration) — Research
+
+**Researched:** 2026-05-17
+**Domain:** Brand integration — font self-hosting, SVG rasterization, MV3 i18n, CSS token ingestion, Vite asset pipeline
+**Confidence:** HIGH on stack/tooling (locally verified); MEDIUM on Cyrillic-extended-Plex sizing; **BLOCKER** on D-05 Newsreader Cyrillic coverage
+
+## Summary
+
+Designer-team handoff v1 (commit `5efc2a8`) lands a 280-line `tokens.css`, 32×32-viewBox `mokosh-mark.svg`, and 240×56 lockup. Engineering's Plan 01-12 ingests these into `src/`, removes the Google Fonts `@import` (MV3 CSP violation), self-hosts WOFF2 (Newsreader + IBM Plex Sans 4w + Plex Mono 2w, Latin + Cyrillic), rasterizes the mark to `icons/icon{16,48,128}.png`, updates `manifest.json:name`+`:description` per D-07/D-08 (via `__MSG_*__` + `_locales/`), wires the 8 operator strings into `_locales/ru/messages.json` + `_locales/en/messages.json`, restyles `src/popup/` per tokens, and replaces hardcoded Russian/placeholder colors with token references.
+
+**Primary recommendation:** Execute in stable order — (1) write the canonical `tokens.css` to `src/shared/tokens.css` minus the Google Fonts `@import`, (2) rasterize PNG icons (rsvg-convert is installed + verified to produce icons that clear all Chrome floors with the existing mark at 16/48/128), (3) build out `fonts/` via `pyftsubset` (installed) + `woff2_compress` (installed) — BUT ONLY for the Plex faces and a Latin-only Newsreader subset; **substitute a Cyrillic-bearing display serif for Russian text** (see BLOCKER below), (4) create `_locales/` and migrate hardcoded Russian strings, (5) wire `manifest.json:name=__MSG_extName__` + `:description=__MSG_extDesc__` + `default_locale:"en"`, (6) restyle popup + smoke.
+
+**BLOCKER (D-05):** Newsreader from Google Fonts / Production Type does NOT cover Cyrillic. The Decision Brief's own embedded `@font-face` declarations confirm this — Newsreader has only `latin / latin-ext / vietnamese` subsets; IBM Plex Sans and Plex Mono have `cyrillic / cyrillic-ext` subsets in addition. Russian-operator audience means display text in Newsreader will silently fall back to `Iowan Old Style → Times New Roman → serif`. See §1 BLOCKER for remediation options.
+
+## User Constraints (from CONTEXT.md / brand-decisions-v1.md)
+
+### Locked Decisions
+
+- **D-01**: Mark concept = `A · Loom (2×2 weave intersection)`. Source SVG is `mokosh-mark.svg`. PNG rasterization is engineering's job.
+- **D-02**: Welcome layout = `A · Hero + Loom dial`. Out of scope for Plan 01-12 (Plan 01-10's responsibility); Plan 01-12 must NOT touch `src/welcome/` content.
+- **D-03**: Voice register = `A · Sober`. Carries to all 8 i18n strings.
+- **D-04**: Palette = `A · Loom` (`tokens.css` `--mks-*` is canonical; replaces engineering placeholders).
+- **D-05**: Type pairing = `A · Newsreader (display) + IBM Plex Sans (UI, 4 weights) + IBM Plex Mono (mono, 2 weights)`. All OFL. Self-host WOFF2; remove Google Fonts `@import`. — **subject to BLOCKER**.
+- **D-06**: Icon strategy = `A · Neutral mark + dynamic badge`. NO per-state PNG sets. Matches existing arch (`chrome.action.setBadgeBackgroundColor` already in use per `src/background/index.ts:45`).
+- **D-07 (USER OVERRIDE)**: `manifest.json:name = "Mokosh — Session Capture"` (not bare `"Mokosh"`). Surface capture purpose externally.
+- **D-08**: Tagline = `«Тридцать секунд назад, всегда под рукой.»` / `"Thirty seconds ago, always at hand."`. Used in `manifest.json:description` + welcome hero.
+- **D-09**: Smoke shipping = `A · Dev-only behind VITE_DEV flag`. — **subject to a no-op clarification**, see §12.
+
+### Claude's Discretion
+
+- The 8 i18n copy strings inherit D-03 Sober by default; per-string overrides surfaced as-encountered. Initial values for each string extracted from Decision Brief §02 — see §10 below for the verbatim text and recommended `__MSG_*__` keys.
+- File layout: `src/shared/tokens.css` vs `src/styles/tokens.css` vs per-surface `tokens.css`. Recommended: **`src/shared/tokens.css`** to match the existing `src/shared/` convention (logger, types, binary).
+- `default_locale` value: `"en"` recommended (Chrome Web Store convention; manifest is globally visible; Russian audience accesses the actual UI which is RU-primary).
+- Font tooling specifics within the chosen WOFF2 self-host approach.
+
+### Deferred Ideas (OUT OF SCOPE)
+
+- Dark theme variant of mark SVG (`.dark` class already in `tokens.css` — but D-06 keeps mark neutral; badge does state work).
+- Welcome page hero (Plan 01-10).
+- Per-state icon variants (D-08 = neutral mark + badge; A-06 PNG set deferred indefinitely).
+- Hi-DPI `icon192.png` (Brief P1, optional; defer unless Plan 01-12 budget allows).
+
+## Phase Requirements
+
+| ID | Description | Research Support |
+|----|-------------|------------------|
+| REQ-video-ring-buffer | Phase 1 anchor requirement; satisfied by Plans 01-01..01-07 | Not directly addressed by Plan 01-12 — but mentioned because Plan 01-12 must not regress any existing video-pipeline test. The 79 tests landed in 01-10 stay GREEN. |
+| (implicit D-04..D-09) | Design integration requirements derived from `brand-decisions-v1.md` | This RESEARCH.md is the source-of-truth synthesis for each. |
+
+---
+
+## 1. WOFF2 self-hosting in MV3 (D-05) — **BLOCKER on Newsreader Cyrillic**
+
+### BLOCKER finding
+
+The Decision Brief's `@font-face` declarations (extracted from
+`.planning/intel/design-incoming/mokosh/dist/Decision Brief (standalone).html`,
+inside the bundler template after JSON-decoding) reveal the actual Google
+Fonts subset structure:
+
+| Family | Weights/styles shipped | Subsets shipped | Cyrillic? |
+|---|---|---|---|
+| Newsreader | normal 400/500/600, italic 400 | `latin`, `latin-ext`, `vietnamese` | **NO** |
+| IBM Plex Sans | normal 400/500/600/700 | `latin`, `latin-ext`, `cyrillic`, `cyrillic-ext`, `greek`, `vietnamese` | YES |
+| IBM Plex Mono | normal 400/500 | `latin`, `latin-ext`, `cyrillic`, `cyrillic-ext`, `vietnamese` | YES |
+
+This is consistent with the Newsreader GitHub README (`productiontype/Newsreader`)
+which states Newsreader covers "Google Fonts Latin Plus glyph set, ... English,
+Western European languages as well as Vietnamese". Production Type's own page
+makes no Cyrillic claim. Per the upstream charset files, Newsreader does not
+include Cyrillic glyphs in any release shipped via Google Fonts.
+
+**Impact on D-05:** Newsreader display text in Russian
+(e.g. `«Тридцать секунд назад, всегда под рукой.»` if it lands on welcome hero
+as `.mks-display-1`) will fall back to the next family in the stack:
+`Newsreader, "Iowan Old Style", "Times New Roman", serif`. On Linux/Chrome OS
+this means Times New Roman or DejaVu Serif. On macOS, Iowan Old Style. On
+Windows, Times New Roman. Each render is a different visual personality and
+none is the loom-warm character that D-05 picks.
+
+**Remediation options for the planner:**
+
+- **R1 (recommended): document the limitation + add Cyrillic-capable serif fallback.** Use Newsreader for Latin text only (welcome EN parallel-text subhead per D-08 — `"Thirty seconds ago, always at hand."`). For Russian display text, the existing fallback chain `Newsreader, "Iowan Old Style", "Times New Roman", serif` already does the work — just verify the Russian welcome hero renders in a visually-acceptable serif on the operator's actual Chrome. Engineering can prepend a Cyrillic-capable OFL serif (e.g. **PT Serif** by ParaType, **EB Garamond**, or **Lora** — all SIL OFL, all have Cyrillic) into the `--mks-font-display` stack so the Russian hero falls onto a curated face instead of a system default. Lowest engineering cost.
+- **R2: switch display family.** Substitute a Cyrillic-bearing OFL serif (PT Serif, EB Garamond, Lora, Source Serif Pro) for Newsreader entirely. Loses the designer's specific aesthetic call. Requires re-coordinating with design team.
+- **R3: extend Newsreader with a custom Cyrillic.** Out of scope; would require a font designer and license review.
+
+**Recommended action for planner:** Surface this to user as a one-paragraph decision question. Default to R1 (smallest scope, preserves designer's call for Latin, adds a curated Cyrillic-capable serif as the next fallback). If user accepts R1, no font for Russian Newsreader needs to be subsetted — only Plex Sans + Plex Mono carry Cyrillic.
+
+### Bundle plan (assumes R1; revise if R2)
+
+For each subsetted WOFF2 file:
+
+```bash
+# Install: already installed on dev machine — pyftsubset (fontTools 4.63.0) + woff2_compress (Google's woff2)
+# Source: download .ttf releases from https://github.com/IBM/plex (Plex Sans v1.1.0, Plex Mono v1.1.0)
+#         and https://github.com/productiontype/Newsreader (variable font)
+
+# Plex Sans 400 Cyrillic-only (smallest possible; covers Russian operator surfaces)
+pyftsubset IBMPlexSans-Regular.ttf \
+  --unicodes='U+0020-007E,U+00A0-00FF,U+0301,U+0400-045F,U+0490-0491,U+04B0-04B1,U+2116' \
+  --flavor=woff2 \
+  --output-file=fonts/IBMPlexSans-Regular-latin-cyrillic.woff2 \
+  --layout-features='*' --no-hinting --desubroutinize
+# Repeat for weights 500, 600, 700.
+
+# Plex Mono 400 + 500 — same subset
+pyftsubset IBMPlexMono-Regular.ttf \
+  --unicodes='U+0020-007E,U+00A0-00FF,U+0400-045F,U+2116' \
+  --flavor=woff2 --output-file=fonts/IBMPlexMono-Regular.woff2 ...
+
+# Newsreader (variable, Latin only per the Brief subset)
+pyftsubset Newsreader[opsz,wght].ttf \
+  --unicodes='U+0020-007E,U+00A0-00FF,U+0152-0153,U+2000-206F,U+20AC,U+2122' \
+  --flavor=woff2 --output-file=fonts/Newsreader-variable.woff2 ...
+```
+
+**Estimated bundle size (verified against Google Fonts subset sizes from public CDN):**
+
+| File | Estimated size |
+|---|---|
+| Plex Sans 400 latin+cyrillic | ~25 KB |
+| Plex Sans 500 latin+cyrillic | ~25 KB |
+| Plex Sans 600 latin+cyrillic | ~25 KB |
+| Plex Sans 700 latin+cyrillic | ~25 KB |
+| Plex Mono 400 latin+cyrillic | ~28 KB |
+| Plex Mono 500 latin+cyrillic | ~28 KB |
+| Newsreader variable, Latin-only | ~60 KB (variable axes inflate) |
+| **Total** | **~216 KB** |
+
+Comfortably under the brief's implicit "≤300 KB" target.
+
+**License files (D-05 OFL):**
+
+- `fonts/LICENSE-IBM-Plex.txt` — copy from https://github.com/IBM/plex/blob/master/LICENSE.txt (SIL OFL 1.1 + IBM copyright lines)
+- `fonts/LICENSE-Newsreader.txt` — copy from https://github.com/productiontype/Newsreader/blob/master/OFL.txt
+- Both: OFL allows embedding without a separate NOTICE file (per OFL FAQ); a `fonts/README.md` linking to each upstream + listing copyright lines is sufficient and is best practice.
+
+### Sources
+
+- [Newsreader on GitHub (productiontype/Newsreader)](https://github.com/productiontype/Newsreader) — "Google Fonts Latin Plus glyph set" claim, no Cyrillic mentioned
+- [IBM Plex on GitHub](https://github.com/IBM/plex) — Plex Sans supports "extended Latin, Arabic, Chinese (Traditional), Cyrillic, Devanagari, Greek, Hebrew, Japanese, Korean, and Thai"
+- [SIL Open Font License 1.1](https://openfontlicense.org/) — embedded fonts have lighter attribution requirements
+- [OFL-FAQ](https://openfontlicense.org/ofl-faq/) — bundled fonts do not require separate distribution copies
+- [Decision Brief embedded `@font-face` declarations](file://.planning/intel/design-incoming/mokosh/dist/Decision%20Brief%20(standalone).html) — primary source for confirmed subset structure
+- [fontTools pyftsubset docs](https://fonttools.readthedocs.io/en/stable/subset/) — `--unicodes` + `--flavor=woff2`
+- [Markos Konstantopoulos on font subsetting](https://markoskon.com/creating-font-subsets/) — practical pyftsubset examples
+- [Walter Ebert on subsetting web fonts](https://walterebert.com/blog/subsetting-web-fonts/) — IBM Plex bandwidth comparisons
+
+---
+
+## 2. Vite @crxjs font asset pipeline
+
+### Findings
+
+- `@crxjs/vite-plugin` (project on `2.0.0-beta.25`; latest stable is `2.4.0`) automatically generates `web_accessible_resources` entries for resources referenced from extension pages (popup, welcome, offscreen, etc.) per the official README: *"Automatic generation of `web_accessible_resources` manifest entries"*.
+- Vite's general asset handling: CSS `url()` references inside imported `.css` files are auto-rebased and emitted with content-hashed names to `dist/assets/`. This works for `.woff2` files placed in `src/shared/fonts/` or similar.
+- The known failure mode is when `chrome.runtime.getURL(<importedAsset>)` is called from a service worker (per [crxjs issue #891](https://github.com/crxjs/chrome-extension-tools/issues/891)) — but this is NOT the popup/welcome font-loading flow. Fonts referenced via `@font-face src: url('../shared/fonts/x.woff2')` inside an extension-page CSS work through Vite's normal rebase pipeline.
+
+### Recommended approach
+
+**Pattern A (recommended): regular `src/` assets.** Place WOFF2 files at `src/shared/fonts/<face>.woff2`. The canonical `src/shared/tokens.css` references them via relative paths:
+
+```css
+@font-face {
+  font-family: "IBM Plex Sans";
+  src: url("./fonts/IBMPlexSans-Regular-latin-cyrillic.woff2") format("woff2");
+  font-weight: 400;
+  font-style: normal;
+  font-display: swap;
+}
+```
+
+When `src/popup/index.html` and `src/welcome/welcome.html` `@import` (or `<link>`) the tokens.css, Vite rebases the URLs, emits the WOFF2 files to `dist/assets/<hash>.woff2`, and rewrites the CSS to point at the hashed names. CRXJS then auto-adds them to `web_accessible_resources` because they're transitively reachable from extension HTML pages.
+
+**Pattern B (fallback if Pattern A misfires): `/public/fonts/`.** Files placed under `public/` are copied verbatim to `dist/` without hashing. Reference as absolute paths `url("/fonts/x.woff2")`. The trade-off: no asset hashing (cache busting requires version bumps), but explicit and tool-independent. Manual `web_accessible_resources` entry needed in `manifest.json`:
+
+```json
+"web_accessible_resources": [
+  { "resources": ["fonts/*.woff2"], "matches": ["<all_urls>"] }
+]
+```
+
+**Validation step (planner: include in execute-plan):** After first build with WOFF2 files, run `grep -r "woff2" dist/manifest.json` and `ls dist/assets/*.woff2` — if WOFF2 files show up in `dist/assets/` AND `web_accessible_resources` mentions them, Pattern A is working. If not, fall back to Pattern B.
+
+### Sources
+
+- [@crxjs/vite-plugin README on GitHub](https://github.com/crxjs/chrome-extension-tools/blob/main/packages/vite-plugin/README.md) — "automatic generation of web_accessible_resources"
+- [Vite Static Asset Handling](https://vite.dev/guide/assets) — CSS `url()` rebasing
+- [crxjs issue #891 (SW asset loading failure)](https://github.com/crxjs/chrome-extension-tools/issues/891) — known pitfall, NOT applicable to popup/welcome font loading
+- Codebase verification: current `vite.config.ts` line 10 sets `injectCss: false` for content scripts only (does not affect popup/welcome CSS); current `manifest.json` has no `web_accessible_resources` (Plan 01-10 adds one for welcome.html)
+
+---
+
+## 3. SVG → PNG rasterization toolchain (D-01)
+
+### Verified locally
+
+Tooling installed on dev machine:
+
+- `rsvg-convert` 2.60.0 (libRSVG via librsvg) — installed at `/usr/bin/rsvg-convert`
+- ImageMagick `convert` (deprecated in v7, use `magick`) — also available
+- `inkscape` 1.4.4 — available
+
+Empirically verified by rasterizing `mokosh-mark.svg`:
+
+```bash
+rsvg-convert -w 16  -h 16  mokosh-mark.svg -o icon16.png  # 406 bytes ✓ (>200)
+rsvg-convert -w 48  -h 48  mokosh-mark.svg -o icon48.png  # 784 bytes ✓ (>500)
+rsvg-convert -w 128 -h 128 mokosh-mark.svg -o icon128.png # 1952 bytes ✓ (>1024)
+```
+
+All three clear the Chrome `imageUtil` floors documented in `assets-spec.md` and the design handoff. PNG output is `8-bit/color RGBA, non-interlaced` per `file(1)`.
+
+### Recommended approach
+
+**One-off rasterization, commit the PNGs.** No build-time automation needed because the mark is stable (designer-handed-off; D-01 locked). A `scripts/rasterize-icons.sh` recipe is documented but only re-runs when the SVG changes:
+
+```bash
+#!/usr/bin/env bash
+set -euo pipefail
+SVG="src/shared/brand/mokosh-mark.svg"  # or wherever the planner lands the SVG
+for size in 16 48 128; do
+  rsvg-convert -w "$size" -h "$size" "$SVG" -o "icons/icon${size}.png"
+  echo "✓ icons/icon${size}.png ($(stat -c%s "icons/icon${size}.png") bytes)"
+done
+```
+
+Run once during execute-plan, commit the resulting `icons/icon{16,48,128}.png` files.
+
+### Anti-pattern
+
+Do NOT add this to `prebuild` — Chrome's `imageUtil` floors are bytes-of-PNG, not bytes-of-source-SVG. Re-rasterizing on every `npm run build` adds 30–80 ms with no value (the inputs are stable per phase). Plan 01-12 should commit static PNGs as deliverables, not generate them in CI.
+
+### Sources
+
+- `rsvg-convert(1)` man page (locally available)
+- [Inkscape command-line export](https://wiki.inkscape.org/wiki/Using_the_Command_Line) — alternative tool
+- Verified locally against `.planning/intel/design-incoming/system/bundle/mokosh-handoff/assets/mokosh-mark.svg`
+
+---
+
+## 4. Mark legibility at 16 px (D-01 risk) — **VERIFIED OK**
+
+### Findings
+
+Empirically rasterized via rsvg-convert at 16/48/128 px. The 2×2 weave mark holds:
+
+- **16 px** (`/tmp/mokosh-rsearch/mark-16.png`, 406 B): Reads as a 4×4-grid silhouette. The two central weave gaps (the "hole" at x=12–14 and y=12.5–13.5) collapse into near-pixel-level dots, but the overall grid pattern is recognizable. Stroke weight at 16 px ≈ 1.1 px effective; corners round slightly via anti-aliasing.
+- **48 px** (784 B): Clean weave rendering with all gaps visible.
+- **128 px** (1952 B): Fully resolved, every gap distinct.
+
+Visual inspection: at 16 px the mark reads as "small frame containing crosshatch" — distinct from generic placeholder shapes. The README claim that "[Newsreader concept] holds at 16 px" (designer handoff handoff.html line 458) is borne out by the rsvg-convert output.
+
+### Recommended approach
+
+**Use the canonical `mokosh-mark.svg` at all three sizes — no 16 px variant needed.** The mark survives at 16 px. The four candidate marks the README mentions ("Surface Kit shows 4 mark candidates") are alternative concepts, not 16 px-rescue variants. With D-01 locked on `A · Loom`, the candidate set doesn't apply.
+
+**No remediation needed.** This risk was pre-mitigated by the designer's choice of a simple weave (4 vertical + 4 horizontal segments inside a rounded square — no fine detail that fails to resolve at low resolution).
+
+### Sources
+
+- Local empirical: rsvg-convert output inspected as image at 16/48/128 px
+- Designer handoff `handoff.html` line 458: "[2×2 weave intersection — see assets/mokosh-mark.svg] Holds at 16 px."
+
+---
+
+## 5. Dark theme variant of mark SVG (D-06)
+
+### Findings
+
+The lockup + mark SVGs hardcode `stroke="#181b2a"` (matches `--mks-ink-900`). The `tokens.css` `.dark` block at line 165 swaps `--mks-surface-inverse` etc., but does NOT touch the mark stroke. D-06 picks "neutral mark + dynamic badge" — the badge does the state work, not an icon swap.
+
+**Three architectural patterns evaluated:**
+
+1. **`currentColor`** — change SVG to `stroke="currentColor"`. Works for *inline* SVG with `<svg style="color: var(--mks-fg-1)">`, but NOT for `<img src="mokosh-mark.svg">` (image elements don't inherit `currentColor`). The `default_icon` and `chrome.action.setIcon` paths use raster PNGs, not SVG, so this pattern doesn't help the toolbar at all.
+2. **Two SVG variants** — `mokosh-mark-light.svg` (`#181b2a` stroke) + `mokosh-mark-dark.svg` (`#faf7f1` stroke for inverse surfaces). Swap based on `prefers-color-scheme`. Useful for *welcome page* hero rendering only.
+3. **Badge-only differentiation (D-06)** — the toolbar PNG icon stays neutral (`#181b2a`) regardless of theme; the colored badge (`chrome.action.setBadgeBackgroundColor`) does the state communication. This is what D-06 picks.
+
+### Recommended approach
+
+**For toolbar PNGs (icon16/48/128):** Single neutral `#181b2a` stroke. The current rasterized PNGs from §3 satisfy D-06 directly. Chrome's toolbar will adapt the visual surrounding (light/dark theme of the browser chrome) but the icon itself stays a fixed ink-on-transparent rendering.
+
+**For inline SVG usage on welcome page (Plan 01-10's territory, not 01-12's):** When Plan 01-10 inlines `mokosh-mark.svg` into the welcome HTML, modify the inline copy to use `stroke="currentColor"` and let CSS `color: var(--mks-fg-1)` control it. This is a Plan 01-10 concern; Plan 01-12 may pre-stage by copying the SVG to `src/shared/brand/mokosh-mark.svg` and leaving the canonical hardcoded-stroke version untouched (the rasterizer needs the stroke explicit for PNG output).
+
+**No dark-variant SVG file needed for Plan 01-12.**
+
+### Sources
+
+- `tokens.css` lines 165–189 (`.dark` block) — confirms surface inversion but no mark color swap
+- `brand-decisions-v1.md` D-06 — "Neutral mark + dynamic badge"
+- MDN `currentColor`: only inherited by inline SVG, not `<img src=svg>` (well-known browser behavior; not vendor-disputed)
+
+---
+
+## 6. Cyrillic subsetting (D-05 corollary) — **superseded by §1 BLOCKER for Newsreader**
+
+### Findings (Plex faces only — Newsreader covered in §1)
+
+Per the canonical Google Fonts subset structure extracted from the Decision Brief:
+
+| Subset | Unicode-range (canonical) | Bytes-per-face-weight (est.) |
+|---|---|---|
+| `cyrillic` (basic) | `U+0301, U+0400-045F, U+0490-0491, U+04B0-04B1, U+2116` | ~10 KB for Plex Sans 400 |
+| `cyrillic-ext` | `U+0460-052F, U+1C80-1C8A, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F` | ~6 KB |
+| `latin` (basic) | `U+0000-00FF, U+0131, U+0152-0153, ... (ASCII + Latin-1 + common punct)` | ~15 KB for Plex Sans 400 |
+
+**Russian operators don't need `cyrillic-ext`** (that's Cyrillic Supplement — historical/extended scripts like Old Church Slavonic, Komi, Yakut). Mokosh's audience uses Modern Russian Cyrillic which lives entirely in `U+0400-04FF` (covered by basic `cyrillic`).
+
+### Recommended subset per face
+
+```bash
+# Russian operator: latin (ASCII for English fallback text) + cyrillic (basic, U+0400-045F)
+# Skip cyrillic-ext (Supplement), latin-ext (Eastern European), greek, vietnamese
+UNICODES='U+0020-007E,U+00A0-00FF,U+0131,U+0152-0153,U+0301,U+0400-045F,U+0490-0491,U+04B0-04B1,U+2116'
+```
+
+Per-face-weight WOFF2 should land at ~25 KB for Plex Sans, ~28 KB for Plex Mono. The size table in §1 is conservative.
+
+### Sources
+
+- Decision Brief embedded `@font-face` declarations (verified extraction; see §1)
+- [`pyftsubset` docs](https://fonttools.readthedocs.io/en/stable/subset/) — `--unicodes` syntax
+- Standard reference: [Markos Konstantopoulos on font subsetting](https://markoskon.com/creating-font-subsets/)
+
+---
+
+## 7. License compliance (D-05)
+
+### Findings
+
+- **IBM Plex Sans + IBM Plex Mono** — SIL OFL 1.1. Upstream license at https://github.com/IBM/plex/blob/master/LICENSE.txt. Copyright "© Copyright IBM Corp. with Reserved Font Names 'Plex' and 'IBM Plex'."
+- **Newsreader** — SIL OFL 1.1. Upstream license at https://github.com/productiontype/Newsreader/blob/master/OFL.txt. Copyright "© 2019 Production Type, Paris."
+- Both: embedding + bundling allowed. No royalty. Per [OFL-FAQ](https://openfontlicense.org/ofl-faq/), embedding a font in a software bundle "does not constitute distribution" for the purposes of mandatory NOTICE shipping. Best practice is still to include the OFL text + copyright lines.
+
+### Recommended file layout
+
+```
+src/shared/fonts/
+├── IBMPlexMono-Regular.woff2          # 400 latin+cyrillic
+├── IBMPlexMono-Medium.woff2           # 500 latin+cyrillic
+├── IBMPlexSans-Regular.woff2          # 400 latin+cyrillic
+├── IBMPlexSans-Medium.woff2           # 500 latin+cyrillic
+├── IBMPlexSans-SemiBold.woff2         # 600 latin+cyrillic
+├── IBMPlexSans-Bold.woff2             # 700 latin+cyrillic
+├── Newsreader-variable.woff2          # variable axes [opsz, wght], latin-only per §1 R1
+├── LICENSE-IBM-Plex.txt               # copy of upstream LICENSE.txt
+├── LICENSE-Newsreader.txt             # copy of upstream OFL.txt
+└── README.md                          # one paragraph: what's bundled, with upstream URLs
+```
+
+`src/shared/fonts/README.md` content (one-pager):
+
+```markdown
+# Bundled fonts
+
+Self-hosted per MV3 CSP (forbids remote @font-face at runtime).
+All faces are SIL OFL 1.1 licensed (see LICENSE-* files in this directory).
+
+## Sources
+
+- IBM Plex Sans + Plex Mono: https://github.com/IBM/plex (Plex Sans v1.1.0, Plex Mono v1.1.0, 2024-11-13)
+- Newsreader: https://github.com/productiontype/Newsreader (variable, 2020+, Production Type for Google Fonts)
+
+## Subsetting
+
+Subsetted via fontTools.pyftsubset to Latin (ASCII + Latin-1) + Cyrillic basic
+(U+0400-045F) for Plex; Latin-only for Newsreader (no Cyrillic glyphs in upstream).
+Russian operator surfaces use Plex Sans/Mono for text rendering; Newsreader is
+display-only for Latin script (welcome EN parallel-text subhead).
+
+## Regenerate
+
+See scripts/subset-fonts.sh.
+```
+
+### Sources
+
+- [SIL OFL 1.1 text](https://openfontlicense.org/)
+- [OFL-FAQ](https://openfontlicense.org/ofl-faq/) — embedded fonts attribution
+- [IBM Plex repo + LICENSE](https://github.com/IBM/plex)
+- [Newsreader repo + OFL.txt](https://github.com/productiontype/Newsreader)
+- [SPDX OFL-1.1](https://spdx.org/licenses/OFL-1.1.html)
+
+---
+
+## 8. `.mks-word` CSS class (lockup SVG dependency)
+
+### Findings
+
+The lockup SVG (`assets/mokosh-lockup.svg`) line 21:
+
+```html
+<text x="48" y="40" class="mks-word">Mokosh</text>
+```
+
+The `.mks-word` class is referenced but NOT defined in delivered `tokens.css`. Without it, the wordmark "Mokosh" inside the lockup SVG renders in the browser default serif at default size — completely off-brand.
+
+### Recommended approach
+
+**Add a one-line definition to `src/shared/tokens.css` (engineering-authored, designer-overridable).** The definition matches the visual specs implied by the lockup SVG geometry (text starts at x=48, baseline at y=40 inside a 240×56 viewBox; visual inspection shows the text occupies about 32 px cap-height):
+
+```css
+/* ── Lockup wordmark ──────────────────────────────────────────────
+   References from mokosh-lockup.svg. Engineering's working definition;
+   designer can override by sending a tokens.css patch. */
+.mks-word {
+  font-family: var(--mks-font-display);
+  font-size: 32px;
+  font-weight: var(--mks-weight-regular);
+  letter-spacing: var(--mks-tracking-display);
+  fill: var(--mks-ink-900);
+}
+```
+
+**Mitigations to surface to designer in commit message:**
+
+```
+docs(01-12): add .mks-word lockup wordmark CSS (engineering working defn)
+
+The lockup SVG `assets/mokosh-lockup.svg` references `.mks-word`
+which was not in delivered tokens.css. This commit adds a working
+definition (32 px Newsreader at --mks-ink-900) so the lockup
+renders. Designer may override by sending a tokens.css patch with
+the canonical sizing.
+```
+
+**If the lockup is used inline in welcome page:** `fill` works via CSS for `<text>` inside inline SVG. If used as `<img src="lockup.svg">`, the CSS doesn't reach inside — the `.mks-word` would need to be applied via a `<style>` element inside the SVG itself (per [SVG2 CSS rules](https://www.w3.org/TR/SVG2/styling.html#StylingWithCSS)). For Plan 01-12, the simplest path: add the CSS to `tokens.css`, and any consumer of the lockup either (a) inlines the SVG into HTML (CSS reaches), or (b) inlines the same class definition into a `<style>` block within the SVG file (small duplication, acceptable).
+
+### Sources
+
+- `assets/mokosh-lockup.svg` line 21 (read verbatim)
+- `tokens.css` lines 14–280 (verified `.mks-word` is absent)
+- [SVG2 § 6: Styling with CSS](https://www.w3.org/TR/SVG2/styling.html#StylingWithCSS) — CSS-from-outside-SVG rules
+
+---
+
+## 9. tokens.css integration into existing src/ (D-04)
+
+### Findings
+
+Current `src/` layout:
+
+```
+src/
+├── background/index.ts        # SW
+├── content/index.ts           # content script
+├── offscreen/{index.html, recorder.ts}
+├── popup/{index.html, index.ts, style.css}   # current popup w/ placeholder palette
+└── shared/{binary.ts, logger.ts, types.ts}   # shared module convention exists
+```
+
+Current popup style (`src/popup/style.css`) uses hardcoded hex (`#2563eb` blue button, `#f8f9fa` body bg, `#dc2626` error) — entirely engineering placeholder colors per the design handoff's diagnostic. Plan 01-12 rewires these to tokens.
+
+**Future welcome page (Plan 01-10's territory) at `src/welcome/welcome.css`** uses hardcoded placeholders too (`#00C853` green button, `#1f1f1f` text) — per current Plan 01-10 contents. Plan 01-12 SHOULD NOT modify Plan 01-10's CSS *unless* the planner explicitly decides to rewire it as a hand-off to Plan 01-10 execution (which is a coordination question).
+
+### Recommended file layout
+
+```
+src/shared/tokens.css       # canonical tokens (this is the single source of truth)
+src/shared/fonts/           # WOFF2 files + LICENSE-* (per §7)
+```
+
+**Import strategy:** Each top-level CSS file (`src/popup/style.css`, `src/welcome/welcome.css`, smoke `data:` URL) prepends a relative `@import`:
+
+```css
+/* src/popup/style.css */
+@import "../shared/tokens.css";
+
+body {
+  background: var(--mks-surface);
+  color: var(--mks-fg-1);
+  font-family: var(--mks-font-ui);
+  ...
+}
+```
+
+Vite resolves `@import` paths at build time and emits a single CSS chunk per HTML entry, deduplicating the token block. **No PostCSS pipeline needed** — CSS custom properties (`--mks-*`) are runtime browser features, resolved by the browser at paint time. Vite ships them as literal CSS without transformation.
+
+### Anti-pattern
+
+Do NOT use Vite's `?inline` CSS imports for tokens — that's for JS-side string imports of CSS source. Tokens go through normal `@import` to participate in the deduplication.
+
+Do NOT split tokens into per-surface files. The handoff is one tokens.css; engineering's job is to keep that one file canonical so designer overrides are single-file patches per `handoff.html` line 27 ("the tokens are wired so a re-skin is a single-file edit").
+
+### Smoke.sh consumption
+
+`smoke.sh` builds a `data:text/html` URL containing the entire smoke page as a base64-encoded blob (verified at `smoke.sh:132–181`). The smoke HTML has inline `<style>` blocks. For Plan 01-12, D-04 wants the smoke page styled per tokens. Three options:
+
+- **A**: Inline the relevant `--mks-*` definitions into the smoke `<style>` block (the smoke page only uses a handful of tokens — `#000`/`#0f0` mono timer overlay etc.). Replace hardcoded colors with the `--mks-*` values *literally* (because `data:` URLs can't `@import` from extension-relative paths). Verbosity cost: ~30 lines added to `smoke.sh`'s SMOKE_HTML heredoc.
+- **B**: Convert smoke from `data:` URL to a Chrome-extension-relative URL (`chrome-extension://<id>/smoke.html`). Adds bundled smoke page artifacts to `dist/` — directly conflicts with D-09 ("dev-only behind VITE_DEV"). Increases bundle size for production.
+- **C**: Leave smoke unstyled per tokens. The smoke page is dev-only; designer's restyling intent is implicit; engineering accepts the imperfection.
+
+**Recommended: A** — copy a minimal subset of `--mks-*` literally into the smoke `<style>` block. Small verbosity cost, no architectural change, satisfies D-04's "rewire smoke.sh to use these tokens" directive in spirit.
+
+### Sources
+
+- Codebase verification: `src/popup/style.css` (read verbatim, lines 1–84)
+- Codebase verification: `vite.config.ts` (no custom PostCSS plugin configured)
+- [Vite CSS handling](https://vite.dev/guide/features.html#css) — `@import` deduplication
+- [MDN CSS custom properties](https://developer.mozilla.org/en-US/docs/Web/CSS/Using_CSS_custom_properties) — runtime resolution
+
+---
+
+## 10. The 8 i18n copy strings (Brief §02)
+
+### Verbatim extraction from Decision Brief §02
+
+Extracted from `.planning/intel/design-incoming/mokosh/dist/Decision Brief (standalone).html` (decoded bundler-template script, §02 "Восемь операторских строк"). All strings inherit D-03 Sober register.
+
+| # | Surface | RU (sober — recommended) | EN (welcome hero only) | Recommended `__MSG_*__` key | Source `src/*` file |
+|---|---|---|---|---|---|
+| 1 | Toolbar tooltip · OFF (action.default_title) | `Mokosh — щёлкните, чтобы начать запись` | — | `tooltipOff` | `src/background/index.ts` (chrome.action.setTitle for OFF state) |
+| 2 | Toolbar tooltip · REC | `Mokosh — идёт запись (00:42)` (with timer interpolation; the `(00:42)` is a runtime substitution) | — | `tooltipRec` (with `$TIME$` placeholder) | `src/background/index.ts` (chrome.action.setTitle for REC state, requires a timer-update interval) |
+| 3 | Toolbar tooltip · ERR | `Mokosh — ошибка записи, щёлкните для восстановления` | — | `tooltipErr` | `src/background/index.ts` (chrome.action.setTitle for ERR state, currently set in setErrorMode) |
+| 4 | Popup idle body / CTA | `Сохранить отчёт об ошибке? / Сохранить отчёт` (the "?" is the body label; "Сохранить отчёт" is the button) | — | `popupSaveCta`, `popupSavePrompt` (two strings: prompt + button) | `src/popup/index.html` (button text "Сохранить отчёт об ошибке"), `src/popup/index.ts` line 38 (idle case) |
+| 5 | Popup done | `Архив сохранён в Загрузки.` | — | `popupSaveDone` | `src/popup/index.ts` (replaces current line 91 `'Архив успешно сохранён!'`) |
+| 6 | Notification startup | `Запись запущена. Я слежу за последними 30 секундами.` | — | `notifStartup` | `src/background/index.ts` (chrome.notifications.create startup message in setRecordingMode flow) |
+| 7 | Notification recovery | `Запись возобновлена. Буфер снова заполняется.` | — | `notifRecovery` | `src/background/index.ts` lines 766–768 (recoveryId notification body) |
+| 8 | Welcome hero · RU (+ EN parallel) | `Тридцать секунд назад, всегда под рукой.` | `Thirty seconds ago, always within reach.` | `welcomeHeroRu`, `welcomeHeroEn` (two keys: RU primary, EN parallel) | `src/welcome/welcome.html` (Plan 01-10's territory; Plan 01-12 produces the messages.json entries even if Plan 01-10 hasn't wired them yet) |
+
+Note on string #4 vs the current popup (`src/popup/index.html` line 12 + `src/popup/index.ts` line 38): existing copy is `Сохранить отчёт об ошибке` (no "?", used as button text). The new sober register splits this into a label-with-question + a button — Plan 01-12 will need a small DOM rework in `src/popup/index.html` to render both. Alternatively, keep the existing single-button form and use string #4 ("Сохранить отчёт об ошибке?") as the combined tooltip + button label. **Recommend:** ask user during execute-plan whether to rework popup DOM. Simplest path: keep current single-button form, use `Сохранить отчёт` (the shorter button form) and put the `Сохранить отчёт об ошибке?` label above as `<p class="popup-prompt">` per the existing `<p class="info-text">` pattern.
+
+Note on string #2 (REC tooltip with `(00:42)`): Chrome's `chrome.action.setTitle` accepts a string, no placeholder syntax. The `$TIME$` interpolation must happen in TS code before the API call. Suggested: define `__MSG_tooltipRecPrefix__` = `"Mokosh — идёт запись"` and concat `' (' + formatElapsed(seconds) + ')'` in JS. This keeps `messages.json` clean and lets the SW format the timestamp.
+
+### Recommended `_locales/` layout
+
+```
+_locales/
+├── en/messages.json    # default_locale fallback; non-Russian system locales see English
+└── ru/messages.json    # primary operator locale
+```
+
+Example `_locales/ru/messages.json`:
+
+```json
+{
+  "extName":         { "message": "Mokosh — Запись сессии",
+                       "description": "manifest.json:name; surfaces in Chrome's extensions list, Web Store, and right-click menus" },
+  "extDesc":         { "message": "Тридцать секунд назад, всегда под рукой.",
+                       "description": "manifest.json:description" },
+  "tooltipOff":      { "message": "Mokosh — щёлкните, чтобы начать запись" },
+  "tooltipRecPrefix":{ "message": "Mokosh — идёт запись",
+                       "description": "Suffix '(MM:SS)' appended at runtime by the SW" },
+  "tooltipErr":      { "message": "Mokosh — ошибка записи, щёлкните для восстановления" },
+  "popupSavePrompt": { "message": "Сохранить отчёт об ошибке?" },
+  "popupSaveCta":    { "message": "Сохранить отчёт" },
+  "popupSaveDone":   { "message": "Архив сохранён в Загрузки." },
+  "notifStartup":    { "message": "Запись запущена. Я слежу за последними 30 секундами." },
+  "notifRecovery":   { "message": "Запись возобновлена. Буфер снова заполняется." },
+  "welcomeHeroRu":   { "message": "Тридцать секунд назад, всегда под рукой." },
+  "welcomeHeroEn":   { "message": "Thirty seconds ago, always within reach.",
+                       "description": "Parallel English subhead under the RU hero on the welcome page" }
+}
+```
+
+And `_locales/en/messages.json` (fallback for non-RU Chrome locales) — same keys, English values, with `extDesc` = `"Thirty seconds ago, always within reach."` and `extName` = `"Mokosh — Session Capture"` (per D-07 user override).
+
+### Sources
+
+- Decision Brief §02 verbatim (extracted via Python JSON-decode of bundler template; see `tool-results/bdp4vyvas.txt`)
+- `src/popup/index.html` + `index.ts` codebase grep
+- `src/background/index.ts:54, 766–768, 868–870` for notification call sites
+- [Chrome i18n message format](https://developer.chrome.com/docs/extensions/reference/api/i18n) — `messages.json` schema
+
+---
+
+## 11. manifest.json i18n via `__MSG_*__` (D-07 + D-08)
+
+### Findings
+
+Per [Chrome i18n docs](https://developer.chrome.com/docs/extensions/reference/api/i18n) and the [default_locale manifest reference](https://developer.chrome.com/docs/extensions/mv3/manifest/default_locale/):
+
+- `manifest.json:name` and `manifest.json:description` accept `__MSG_<key>__` references — both fields support i18n.
+- `default_locale` field is REQUIRED if `_locales/` directory exists. Without it, `_locales/` is ignored.
+- Lookup order: user's preferred locale (e.g. `ru_RU`) → locale without region (`ru`) → `default_locale` → first-found in directory.
+- "As long as the default locale's messages.json file has a value for every string, your extension will run no matter how sparse a translation is" (per Chrome docs).
+- Chrome supports 54 store-listing locales; Russian (`ru`) is among them.
+
+### Recommended approach
+
+```json
+{
+  "manifest_version": 3,
+  "name": "__MSG_extName__",
+  "version": "1.0.0",
+  "description": "__MSG_extDesc__",
+  "default_locale": "en",
+  "permissions": [...],
+  ...
+  "action": {
+    "default_popup": "src/popup/index.html",
+    "default_title": "__MSG_tooltipOff__",   // NEW per #1 above
+    "default_icon": {...}
+  },
+  ...
+}
+```
+
+**Why `default_locale: "en"`:**
+
+- The Chrome Web Store fallback metadata (when displayed in a non-RU browser) uses `default_locale`. Setting it to `"en"` means the store listing for non-Russian users sees the English name + description, while RU-locale users (the operator audience) see the Russian.
+- If `default_locale: "ru"`, then non-RU locales would see Russian (likely rendered correctly in the store but jarring for a Polish/German viewer).
+- The Russian operator audience accesses the actual UI which is RU-localized regardless of `default_locale` — `default_locale` only controls fallback.
+
+**If the user prefers `default_locale: "ru"`** (operator-only deployment, no Chrome Web Store distribution): set it to `"ru"`. The mechanism is the same; only the fallback differs.
+
+### Anti-pattern
+
+Do NOT use `__MSG_@@extension_id__` in manifest.json — the docs explicitly note "The special message `@@extension_id` ... doesn't work in manifest files."
+
+Do NOT skip `default_locale` if `_locales/` exists — manifest validation fails at install time.
+
+### Sources
+
+- [Chrome i18n API](https://developer.chrome.com/docs/extensions/reference/api/i18n)
+- [Manifest default_locale](https://developer.chrome.com/docs/extensions/mv3/manifest/default_locale/)
+- [Localization message formats](https://developer.chrome.com/docs/extensions/mv2/i18n-messages/) — MV2 doc but format unchanged in MV3
+- [How to Add i18n to Chrome Extension MV3 (Stefan Van Damme, 2023)](https://www.stefanvd.net/blog/2023/04/24/how-to-add-internationalization-i18n-chrome-extension/)
+
+---
+
+## 12. VITE_DEV smoke-page gating (D-09) — **NEAR-NO-OP**
+
+### Findings
+
+Verified by grepping the entire `src/` tree:
+
+```bash
+$ grep -rn "smoke\|SMOKE\|data:text/html" src/
+# (empty)
+$ find dist -name "smoke*" -o -name "*SMOKE*"
+# (empty)
+```
+
+`smoke.sh` is a standalone bash script. The smoke page HTML is embedded as a heredoc inside `smoke.sh:132–181` and assembled into a `data:text/html,...` URL at line 181. The `data:` URL is passed to Chrome as a command-line argument:
+
+```bash
+SMOKE_DATA_URL="data:text/html,$(printf '%s' "${SMOKE_HTML}" | python3 -c 'import sys,urllib.parse;print(urllib.parse.quote(sys.stdin.read(), safe=""))')"
+```
+
+`SMOKE_HTML` exists only in shell process memory. Nothing in `src/` references it. Vite's build pipeline has zero awareness of `smoke.sh`. `dist/` carries no smoke artifacts.
+
+### Why D-09 ("dev-only behind VITE_DEV") is a near-no-op
+
+The decision was framed as if smoke might leak into the production bundle. **It can't** — smoke lives outside Vite's input set entirely. The production `dist/` does not ship smoke regardless of any flag.
+
+### Recommended approach
+
+**Document the existing state — minimal code change.** Plan 01-12 adds two artifacts to satisfy D-09's spirit:
+
+1. **`scripts/README.md` (new file, 1 paragraph):** "Diagnostic / smoke scripts live in `smoke.sh` and `scripts/*`. These are dev-only tools and are not bundled by `npm run build`. The production `dist/` produced by `npm run build` does NOT contain smoke artifacts (verified by grep of `dist/` after every build)."
+2. **`vite.config.ts` add a `define` block (defensive, for any future inline smoke flag):**
+   ```ts
+   define: {
+     // D-09: any future inline-smoke-feature check should use this flag.
+     // Currently smoke lives entirely in smoke.sh; this flag is reserved
+     // for future code that wants conditional dev-only behavior.
+     __VITE_DEV__: JSON.stringify(process.env.VITE_DEV === '1' || !!process.env.npm_lifecycle_event?.startsWith('dev')),
+   },
+   ```
+
+**Optional (recommended but not required):** Add a vitest test that asserts `dist/` does NOT contain `smoke` strings after build:
+
+```ts
+// tests/build/no-smoke-in-dist.test.ts
+it('dist/ contains no smoke artifacts', () => {
+  // ...recursively read dist/, assert no file path or content contains 'smoke'
+});
+```
+
+If the user wants stronger guarantees (D-09 audit-ready), this test is the right shape.
+
+### Anti-pattern
+
+Do NOT add `if (import.meta.env.VITE_DEV) { ... smoke code ... }` blocks to `src/` files — there are no such blocks today, and creating them would introduce the very leak D-09 is asking to prevent. The current architecture (smoke isolated to a shell script) is already the safest.
+
+### Sources
+
+- Codebase verification (grep results above)
+- `smoke.sh` line 132–181 (read verbatim)
+- [Vite env vars + modes](https://vite.dev/guide/env-and-mode) — `import.meta.env.VITE_*` pattern
+- [Vite define option](https://vite.dev/config/shared-options.html#define) — for `__VITE_DEV__` constant injection
+
+---
+
+## 13. tokens.css line 12 Google Fonts @import (CSP migration)
+
+### Findings
+
+Verified — `tokens.css` line 12 is:
+
+```css
+@import url('https://fonts.googleapis.com/css2?family=Newsreader:ital,opsz,wght@0,6..72,400;0,6..72,500;0,6..72,600;1,6..72,400&family=IBM+Plex+Sans:wght@400;500;600;700&family=IBM+Plex+Mono:wght@400;500&display=swap');
+```
+
+This violates MV3 CSP. Per [Chrome MV3 CSP docs](https://developer.chrome.com/docs/extensions/reference/manifest/content-security-policy), the default extension-pages CSP is `script-src 'self'; object-src 'self';` plus `style-src 'self' 'unsafe-inline';` for stylesheets. The `style-src 'self'` directive prevents the Google Fonts stylesheet from loading at runtime. (The `font-src` directive defaults to `'self'` as well, so even if the CSS loaded, the `@font-face src: url(https://fonts.gstatic.com/...)` inside would also fail.)
+
+In practice, this means popups built today using the unmodified tokens.css would silently fall back to system serif/sans because the `@font-face` declarations never get loaded.
+
+### Recommended migration
+
+Replace line 12 with local `@font-face` rules pointing at self-hosted WOFF2 files in `src/shared/fonts/`. Per the chosen weight matrix (D-05; subject to §1 BLOCKER R1 — Newsreader Latin-only):
+
+```css
+/* ── Self-hosted fonts (MV3 CSP) ──
+   Faces and weights per D-05. Subsetting: Plex Sans + Plex Mono are
+   Latin + Cyrillic (U+0400-045F); Newsreader is Latin-only (no
+   Cyrillic glyphs in upstream — see RESEARCH.md §1 BLOCKER R1). */
+
+/* IBM Plex Sans 400 / 500 / 600 / 700, normal */
+@font-face {
+  font-family: "IBM Plex Sans";
+  src: url("./fonts/IBMPlexSans-Regular.woff2") format("woff2");
+  font-weight: 400; font-style: normal; font-display: swap;
+}
+@font-face {
+  font-family: "IBM Plex Sans";
+  src: url("./fonts/IBMPlexSans-Medium.woff2") format("woff2");
+  font-weight: 500; font-style: normal; font-display: swap;
+}
+@font-face {
+  font-family: "IBM Plex Sans";
+  src: url("./fonts/IBMPlexSans-SemiBold.woff2") format("woff2");
+  font-weight: 600; font-style: normal; font-display: swap;
+}
+@font-face {
+  font-family: "IBM Plex Sans";
+  src: url("./fonts/IBMPlexSans-Bold.woff2") format("woff2");
+  font-weight: 700; font-style: normal; font-display: swap;
+}
+
+/* IBM Plex Mono 400 / 500, normal */
+@font-face {
+  font-family: "IBM Plex Mono";
+  src: url("./fonts/IBMPlexMono-Regular.woff2") format("woff2");
+  font-weight: 400; font-style: normal; font-display: swap;
+}
+@font-face {
+  font-family: "IBM Plex Mono";
+  src: url("./fonts/IBMPlexMono-Medium.woff2") format("woff2");
+  font-weight: 500; font-style: normal; font-display: swap;
+}
+
+/* Newsreader variable — Latin only (no Cyrillic in upstream) */
+@font-face {
+  font-family: "Newsreader";
+  src: url("./fonts/Newsreader-variable.woff2") format("woff2-variations"),
+       url("./fonts/Newsreader-variable.woff2") format("woff2");
+  font-weight: 400 700;     /* variable axis range */
+  font-style: normal;
+  font-display: swap;
+}
+@font-face {
+  font-family: "Newsreader";
+  src: url("./fonts/Newsreader-italic-variable.woff2") format("woff2-variations"),
+       url("./fonts/Newsreader-italic-variable.woff2") format("woff2");
+  font-weight: 400 700;
+  font-style: italic;
+  font-display: swap;
+}
+```
+
+**Rule count: 8** (4 Plex Sans + 2 Plex Mono + 2 Newsreader variable). Less than the 12–18 estimate in the prompt because using a variable font for Newsreader collapses 4 static-weight rules into 2 (one per style).
+
+If §1 R1 is adopted with an additional Cyrillic-capable serif fallback (e.g. PT Serif), add 2–4 more `@font-face` rules for that face.
+
+### Anti-pattern
+
+Do NOT use the `format('woff2-variations')` hint with a fixed-weight WOFF2 file — the hint is for variable fonts only. Browsers without variable-font support fall back to the second `src` URL (`format('woff2')`).
+
+Do NOT keep the Google Fonts `@import` "for dev fallback" — MV3 CSP refuses it in *all* modes (dev + prod alike); leaving it in would generate console errors during development.
+
+### Sources
+
+- `tokens.css` line 12 (verbatim)
+- [Chrome MV3 CSP manifest docs](https://developer.chrome.com/docs/extensions/reference/manifest/content-security-policy) — default `style-src 'self'`, `font-src 'self'`
+- [MDN @font-face](https://developer.mozilla.org/en-US/docs/Web/CSS/@font-face) — `font-weight: 400 700` range syntax for variable fonts
+- [CSS Fonts Module 4 § variable fonts](https://www.w3.org/TR/css-fonts-4/#font-weight-prop) — `format('woff2-variations')` hint
+
+---
+
+## Architectural Responsibility Map
+
+| Capability | Primary Tier | Secondary Tier | Rationale |
+|---|---|---|---|
+| Brand mark display (toolbar PNG) | Browser (Chrome action API) | — | `chrome.action.setIcon` consumes PNG; only the SW initially configures; rendering is browser-owned |
+| Brand mark display (welcome inline SVG) | Browser (DOM) | Frontend Server (built HTML) | Plan 01-10 inlines the SVG into welcome.html; Vite builds the HTML; browser paints |
+| CSS tokens | Browser (CSS custom properties) | — | All `--mks-*` resolve at paint time in the browser; no SSR; Vite ships them as literal CSS |
+| Font loading (WOFF2) | Browser | CDN/Static (Vite-emitted `dist/assets/`) | Browser parses `@font-face`, fetches from extension origin; Vite asset pipeline emits + hashes |
+| i18n string resolution (`__MSG_*__`) | Browser (Chrome i18n runtime) | CDN/Static (`_locales/*/messages.json`) | Chrome reads `_locales/` at install time, substitutes at runtime; no server involvement |
+| Manifest:name + :description | Chrome runtime (manifest parser) | — | Chrome reads manifest, substitutes `__MSG_*__`, displays in Web Store / Extensions list |
+| Popup HTML/CSS rendering | Browser | Frontend (built HTML) | Popup is a self-contained Chrome extension HTML page; browser-only rendering |
+| Smoke page styling | Browser (data: URL DOM) | — | `data:text/html` URL renders client-side; no Vite bundling involved |
+
+---
+
+## Standard Stack
+
+### Core
+
+| Library / tool | Version (verified) | Purpose | Why standard |
+|---|---|---|---|
+| `@crxjs/vite-plugin` | 2.0.0-beta.25 (project); 2.4.0 (latest) | MV3 bundle + manifest rewriting + WAR auto-generation | Project already uses it; required for MV3 ergonomics on Vite |
+| `vite` | 5.4.2 (project); 8.0.13 (latest) | Build tool; CSS @import dedup; asset hashing | Project already uses it; Vite native @import handling resolves tokens.css from anywhere in src/ |
+| `fontTools` (`pyftsubset`) | 4.63.0 (verified locally) | WOFF2 subsetting | Industry standard; preinstalled on dev machine |
+| `woff2_compress` (Google's `woff2`) | installed via `/usr/bin/woff2_compress` | WOFF2 encoding | Native compression; what pyftsubset uses under the hood when `--flavor=woff2` is specified |
+| `rsvg-convert` (librsvg) | 2.60.0 (verified locally) | SVG → PNG rasterization | Reliable; produces valid 8-bit RGBA PNGs that clear all Chrome `imageUtil` floors |
+
+### Supporting
+
+| Library / tool | Version | Purpose | When to use |
+|---|---|---|---|
+| `vitest` | 4 (project) | Unit tests | Plan 01-12 adds 1–3 tests (manifest i18n shape, fonts present, no smoke in dist) |
+| Newsreader (Production Type) | variable, current upstream | Display serif (Latin only) | Welcome page Latin headlines, lockup wordmark |
+| IBM Plex Sans | v1.1.0 (2024-11-13) | UI body sans, Cyrillic + Latin | Popup, welcome RU body, all `--mks-font-ui` |
+| IBM Plex Mono | v1.1.0 (2024-11-13) | Diagnostic mono, Cyrillic + Latin | Timer overlay (smoke), code-like UI labels |
+| PT Serif or EB Garamond or Lora (optional, §1 R1) | OFL | Cyrillic-capable serif fallback for Russian display | Russian welcome hero, RU display text falling out of Newsreader stack |
+
+### Alternatives considered
+
+| Instead of | Could use | Tradeoff |
+|---|---|---|
+| `rsvg-convert` | `inkscape --export-png` | Inkscape is heavier (X server may be needed for headless run); rsvg-convert is purer + smaller |
+| `pyftsubset` | `glyphhanger` (extracts unicode-range from HTML) | glyphhanger is for *discovering* needed glyphs from real content; not needed when subset ranges are known (we have the Google Fonts canonical ranges) |
+| Newsreader (D-05) | PT Serif (Cyrillic-capable display serif) | Loses designer's specific D-05 choice; gains Russian rendering correctness — see §1 BLOCKER |
+| `_locales/` for i18n | Hardcoded RU strings only | Locks out future EN store distribution; `_locales/` is one-time setup cost; manifest:name needs it anyway for D-07 EN listing |
+| Asset path in `src/shared/fonts/` (Pattern A) | `/public/fonts/` (Pattern B) | Pattern A: hashed names, deduplication; Pattern B: stable names, no @crxjs WAR auto-gen |
+
+### Installation
+
+```bash
+# All required tools are ALREADY installed on dev machine; verified:
+which pyftsubset    # /usr/bin/pyftsubset (fontTools 4.63.0)
+which woff2_compress # /usr/bin/woff2_compress
+which rsvg-convert  # /usr/bin/rsvg-convert (2.60.0)
+
+# No npm installs needed for Plan 01-12 — the tooling is all native binaries.
+# IF the planner wants asset-pipeline tests, no new dev-deps either; vitest is already present.
+
+# Font source downloads (one-off, will land via curl in execute-plan):
+# - https://github.com/IBM/plex/releases (Plex Sans + Plex Mono v1.1.0)
+# - https://github.com/productiontype/Newsreader/releases (variable WOFF2 + TTF)
+```
+
+### Version verification
+
+Verified versions are current as of 2026-05-17 dev machine probe (`npm view` for npm packages; `which`/`--version` for system binaries). No package install needed for Plan 01-12 execution — Vite + crxjs versions stay where the project currently has them (upgrading Vite from 5 → 8 is out of scope for a brand-integration plan).
+
+---
+
+## Architecture Patterns
+
+### Pattern 1: Tokens-first CSS
+
+**What:** Every CSS rule consuming a color, font-family, spacing, or radius value references a `--mks-*` custom property defined in `src/shared/tokens.css`. No literal hex / px / font-family strings in `src/popup/style.css`, `src/welcome/welcome.css`, or smoke HTML.
+
+**When to use:** All surfaces touched by Plan 01-12 (popup, smoke; welcome is Plan 01-10's).
+
+**Example:**
+```css
+/* src/popup/style.css after Plan 01-12 */
+@import "../shared/tokens.css";
+
+body {
+  background: var(--mks-surface);
+  color: var(--mks-fg-1);
+  font-family: var(--mks-font-ui);
+  padding: var(--mks-space-4);
+}
+.save-button {
+  background: var(--mks-rec);            /* madder for the SAVE button per D-04 */
+  color: var(--mks-fg-inverse);
+  border: var(--mks-border-width) solid var(--mks-border-strong);
+  border-radius: var(--mks-radius-md);
+  box-shadow: var(--mks-shadow-1);
+  font-family: var(--mks-font-ui);
+  font-weight: var(--mks-weight-semibold);
+}
+```
+
+### Pattern 2: i18n `__MSG_*__` at every Chrome API call site
+
+**What:** Every call to `chrome.action.setTitle`, `chrome.notifications.create`, `chrome.action.setBadgeText`, and any DOM-rendered Russian string uses `chrome.i18n.getMessage('key')` instead of a literal.
+
+**When to use:** Every operator-facing string. Plan 01-12 audits `src/background/index.ts` + `src/popup/index.ts` for hardcoded RU strings and migrates each.
+
+**Example:**
+```ts
+// src/background/index.ts (was: 'Запись возобновлена')
+chrome.notifications.create(recoveryId, {
+  type: 'basic',
+  iconUrl: chrome.runtime.getURL(NOTIFICATION_ICON_PATH),
+  title: chrome.i18n.getMessage('notifRecoveryTitle'),
+  message: chrome.i18n.getMessage('notifRecovery'),
+});
+
+// src/popup/index.ts (was: buttonText.textContent = 'Сохранить отчёт об ошибке')
+buttonText.textContent = chrome.i18n.getMessage('popupSaveCta');
+```
+
+### Pattern 3: Single source of truth for tokens
+
+**What:** `src/shared/tokens.css` is canonical. The handoff `tokens.css` is the input; engineering's `src/shared/tokens.css` is its production-ready descendant (Google Fonts `@import` replaced, `.mks-word` class added). The Decision Brief's `tokens.css` and the handoff's preview do NOT get bundled — only the engineering canonical.
+
+### Anti-patterns to avoid
+
+- **Per-surface mini-tokens.** Do NOT create `src/popup/popup-tokens.css` or similar. One tokens.css.
+- **Inline color literals "for clarity".** Defeats the purpose. Use the token.
+- **Skipping `_locales/en/` because audience is RU.** Manifest validation requires `default_locale` to have a messages.json. Plan 01-12 ships both.
+- **Loading fonts with `chrome.runtime.getURL` from inside JS.** `@font-face url("./fonts/x.woff2")` in CSS is the only correct path (CSP-safe, Vite-rebased).
+
+---
+
+## Don't Hand-Roll
+
+| Problem | Don't build | Use instead | Why |
+|---|---|---|---|
+| Font subsetting | Custom Python script reading .ttf bytes | `pyftsubset --flavor=woff2 --unicodes=...` | Glyph metric preservation + variable-axis-aware + handles ligatures correctly |
+| SVG → PNG | Custom canvas rasterizer in Node | `rsvg-convert` or Inkscape | RGBA alpha, sub-pixel anti-aliasing, ImageMagick parity |
+| i18n key resolution | Custom string-template engine | `chrome.i18n.getMessage` | Native Chrome integration; manifest substitution; locale fallback chain |
+| WOFF2 compression | Custom Brotli encoder | `woff2_compress` (Google's reference impl) | The reference; what pyftsubset already calls internally |
+| CSS custom properties → static colors | PostCSS plugin to inline | Use `var(--mks-*)` at runtime | Browser-native; runtime themable via `.dark` class addition |
+
+**Key insight:** All five problems have battle-tested solutions in standard tooling. Engineering's role in Plan 01-12 is integration + wiring, not building. The single piece of "logic" Plan 01-12 writes is the `__MSG_*__` migration pass over the 8–12 hardcoded Russian strings + the `tokens.css` adoption — neither is library-grade work.
+
+---
+
+## Runtime State Inventory
+
+Plan 01-12 includes brand-related runtime state changes; checking all five categories:
+
+| Category | Items Found | Action Required |
+|---|---|---|
+| Stored data | `chrome.storage.local` key `onboarding-completed` (boolean, Plan 01-10). No PII; no brand text stored. | None — brand changes don't touch storage. |
+| Live service config | `chrome.action.setTitle()` / `setBadgeText()` calls in `src/background/index.ts` currently pass literal Russian strings. After Plan 01-12, they pass `chrome.i18n.getMessage(...)`. Runtime state (the actual displayed tooltip / badge text per active locale) changes on next SW startup after the extension reload. | Code edit; no manual user action required. |
+| OS-registered state | `manifest.json:name` changes from `"AI Call Recorder"` → `"Mokosh — Session Capture"` (per D-07). Chrome stores the manifest name in the extensions list. On `chrome://extensions` reload, the displayed name will update; old name remains briefly in any cached store listing. | None — Chrome handles on reload. |
+| Secrets / env vars | None — no secrets in brand integration. | None. |
+| Build artifacts | `dist/icons/icon{16,48,128}.png` currently hold the placeholder PNGs (dark square + green dot per `assets-spec.md` Path A description; verified file sizes 574 B / 1153 B / 2615 B in working tree at `/home/parf/projects/work/repremium/icons/`). After Plan 01-12 rasterizes the new mark, these are overwritten in source `icons/` and re-mirrored into `dist/icons/` on next `npm run build`. Also: `dist/manifest.json` will reflect new `name`/`description`/`default_locale`/`__MSG_*__` references; `dist/_locales/` will be a new directory. | `npm run build` after Plan 01-12 changes. Smoke test re-runs the operator UAT to confirm the new icons render correctly in toolbar + notification. |
+
+**Verified by:** Codebase grep + file system probe. Nothing in `chrome.storage.session`, no IndexedDB brand caches, no remote services configured per brand identity.
+
+---
+
+## Common Pitfalls
+
+### Pitfall 1: WOFF2 silent fallback to system fonts
+
+**What goes wrong:** A misnamed font-family in `@font-face` (e.g. `font-family: "IBM Plex Sans Variable"` instead of `"IBM Plex Sans"`) doesn't error — the browser silently falls back to the next family in the stack (`"Segoe UI", -apple-system, ...`). Visual result: clean-looking sans-serif text, but NOT IBM Plex.
+
+**Why it happens:** CSS `@font-face` matching is name-based; a typo creates a phantom face that no `var(--mks-font-ui)` reference resolves to.
+
+**How to avoid:** Match the `font-family` name in `@font-face` EXACTLY to the name in `var(--mks-font-ui)` (`"IBM Plex Sans"` quoted, with the trailing space-and-Sans). The `tokens.css` already names them correctly; just verify each new `@font-face` rule matches.
+
+**Warning signs:** Inspect popup with DevTools → Computed styles → font-family — should read `"IBM Plex Sans"` as the *applied* family, not `"Segoe UI"`. If `"Segoe UI"` appears, the `@font-face` didn't load.
+
+### Pitfall 2: Chrome notification icon silently rejecting PNGs
+
+**What goes wrong:** `chrome.notifications.create({iconUrl})` returns no error but the notification renders with a blank gray placeholder instead of the icon.
+
+**Why it happens:** Chrome's `imageUtil` silently rejects PNGs below ~1 KB at 128×128 — a known artifact found during Plan 01-09 debugging (per `assets-spec.md` line 72). The rejection has no API surface; the only signal is "no icon."
+
+**How to avoid:** Ensure `icons/icon128.png` is ≥ 1024 bytes. The rsvg-convert output at 128×128 produces ~1952 B (verified locally) — well above the floor.
+
+**Warning signs:** Run smoke.sh, click SAVE, wait for the recovery notification. If the notification has no left-icon, the PNG was rejected. Plan 01-09's empirical UAT covers this; Plan 01-12's icon-replacement should re-run that UAT.
+
+### Pitfall 3: `__MSG_*__` substitution failing in HTML
+
+**What goes wrong:** Putting `__MSG_popupSaveCta__` literally in `src/popup/index.html` as text content does NOT get substituted. The string renders to the user verbatim.
+
+**Why it happens:** `__MSG_*__` substitution only works in (a) `manifest.json` fields, (b) CSS via i18n predefined messages, and (c) JavaScript-side via `chrome.i18n.getMessage()`. HTML text content is NOT processed.
+
+**How to avoid:** In HTML, leave the static text empty (or use a sensible default) and populate it from JS using `chrome.i18n.getMessage()` after `DOMContentLoaded`:
+
+```html
+<!-- src/popup/index.html -->
+<button id="saveButton" class="save-button" disabled>
+  <span class="button-text"></span>  <!-- populated by JS -->
+</button>
+```
+```ts
+// src/popup/index.ts in init()
+const buttonText = saveButton.querySelector('.button-text') as HTMLSpanElement;
+buttonText.textContent = chrome.i18n.getMessage('popupSaveCta');
+```
+
+**Warning signs:** Popup renders with `__MSG_*__` strings visible — substitution wasn't applied.
+
+### Pitfall 4: Default locale missing a key
+
+**What goes wrong:** A `chrome.i18n.getMessage('foo')` call returns an empty string when the user's locale messages.json has `foo` but the default_locale messages.json doesn't.
+
+**Why it happens:** Chrome falls back to default_locale on any missing key in the user's locale — but if default_locale itself lacks the key, the chain ends. `chrome.i18n.getMessage` returns `""` (no warning).
+
+**How to avoid:** Maintain the rule "every key present in any `_locales/*/messages.json` MUST be present in `_locales/<default_locale>/messages.json`." Write a vitest test if defensive coverage is wanted:
+
+```ts
+// tests/i18n/locale-parity.test.ts
+it('every key in ru/messages.json exists in en/messages.json', () => {
+  const ru = JSON.parse(readFileSync('_locales/ru/messages.json', 'utf8'));
+  const en = JSON.parse(readFileSync('_locales/en/messages.json', 'utf8'));
+  for (const k of Object.keys(ru)) expect(en).toHaveProperty(k);
+});
+```
+
+**Warning signs:** Empty strings in popup / notification body.
+
+### Pitfall 5: Vite hashing breaks @font-face url() in dev mode
+
+**What goes wrong:** In dev mode (`npm run dev`), the WOFF2 file path `./fonts/IBMPlexSans-Regular.woff2` works, but on `npm run build` the output `@font-face src` becomes `url("/assets/IBMPlexSans-Regular-<hash>.woff2")` — same file, hashed name.
+
+**Why it happens:** Vite's asset pipeline hashes assets for cache busting. The `@import "../shared/tokens.css"` in popup CSS gets re-emitted with hashed URLs.
+
+**How to avoid:** This is correct behavior; the dev/prod discrepancy is intentional. The pitfall is only when the planner inspects `dist/manifest.json` for a specific filename — use a regex pattern instead. CRXJS handles `web_accessible_resources` registration based on the hashed names automatically.
+
+**Warning signs:** Hardcoded asset paths in tests; tests fail in build mode but pass in dev mode.
+
+---
+
+## Code Examples
+
+Verified patterns from official sources + designer handoff:
+
+### Subsetting a WOFF2 with pyftsubset
+
+```bash
+# Source: fontTools.readthedocs.io/en/stable/subset/
+# Verified locally: pyftsubset 4.63.0 installed at /usr/bin/pyftsubset
+
+pyftsubset IBMPlexSans-Regular.ttf \
+  --unicodes='U+0020-007E,U+00A0-00FF,U+0131,U+0152-0153,U+0301,U+0400-045F,U+0490-0491,U+04B0-04B1,U+2116' \
+  --flavor=woff2 \
+  --output-file=src/shared/fonts/IBMPlexSans-Regular.woff2 \
+  --layout-features='*' \
+  --no-hinting \
+  --desubroutinize
+```
+
+### Rasterizing a PNG icon at a specific size
+
+```bash
+# Source: rsvg-convert(1) man page (locally available)
+# Verified locally: produces RGBA 8-bit non-interlaced PNG that clears Chrome floors
+
+rsvg-convert -w 128 -h 128 src/shared/brand/mokosh-mark.svg -o icons/icon128.png
+stat -c%s icons/icon128.png  # confirm ≥1024 bytes (verified: ~1952)
+```
+
+### manifest.json with `__MSG_*__` + `default_locale`
+
+```json
+{
+  "manifest_version": 3,
+  "name": "__MSG_extName__",
+  "version": "1.0.0",
+  "description": "__MSG_extDesc__",
+  "default_locale": "en",
+  "action": {
+    "default_popup": "src/popup/index.html",
+    "default_title": "__MSG_tooltipOff__",
+    "default_icon": {
+      "16":  "icons/icon16.png",
+      "48":  "icons/icon48.png",
+      "128": "icons/icon128.png"
+    }
+  },
+  "icons": {
+    "16":  "icons/icon16.png",
+    "48":  "icons/icon48.png",
+    "128": "icons/icon128.png"
+  }
+}
+```
+
+### Reading an i18n string from JS
+
+```ts
+// Source: developer.chrome.com/docs/extensions/reference/api/i18n
+// chrome.i18n.getMessage(messageName: string, substitutions?: string | string[]): string
+
+const cta = chrome.i18n.getMessage('popupSaveCta');
+buttonText.textContent = cta;
+
+// With substitution placeholder ($1):
+// messages.json: "tooltipRecWithTime": { "message": "Mokosh — идёт запись ($1)" }
+const tooltip = chrome.i18n.getMessage('tooltipRecWithTime', formatElapsed(seconds));
+chrome.action.setTitle({ title: tooltip });
+```
+
+---
+
+## State of the Art
+
+| Old approach | Current approach | When changed | Impact |
+|---|---|---|---|
+| Bundle TTF / OTF directly | WOFF2 only | ~2020 (universal browser support) | 30–50% smaller, native browser parsing |
+| Static-weight WOFF2 files | Variable font WOFF2 | 2018 (Chrome 62+, FF 62+) | Single file replaces 5–9 weight files for Newsreader |
+| Inline manifest:name | `__MSG_*__` + `_locales/` | Pre-MV3 | Required for Chrome Web Store store-listing localization |
+| Google Fonts `@import` in MV2 popups | Self-hosted WOFF2 in `dist/` | MV3 mandate (2024 deprecation of MV2) | Forced by CSP `style-src 'self'` + `font-src 'self'` |
+| Per-state PNG icon swaps via `chrome.action.setIcon` | Neutral mark + `setBadgeBackgroundColor` | 2015+ best practice | Lower asset count; faster state transitions; no PNG decoding per state change |
+| `convert` (ImageMagick) for SVG → PNG | `rsvg-convert` (librsvg) | (preference shift, both still work) | rsvg-convert known-good for Inkscape-authored SVGs and produces predictable byte counts |
+
+**Deprecated / outdated for this project:**
+
+- **A-06 per-state PNG variants** (per D-06 = neutral mark + badge). Do not produce A-06 deliverables.
+- **`@import url(...remote...)`** (per MV3 CSP). Removed from `tokens.css` in Plan 01-12.
+- **Engineering placeholder palette** (`#2563eb`, `#dc2626`, etc. in `src/popup/style.css` and SW `BADGE_REC_COLOR = '#00C853'`). Replaced by `--mks-rec` etc. **Note:** `src/background/index.ts:45` has `BADGE_REC_COLOR = '#00C853'` as a TS literal — the badge color is set via `chrome.action.setBadgeBackgroundColor` which takes an `[r, g, b, a]` tuple OR a hex string. JS can't `var(--mks-*)` directly; Plan 01-12 needs to mirror the token value as a TS constant (e.g. `BADGE_REC_COLOR = '#b2543d' /* --mks-madder-600 */`). Document the dual ownership clearly.
+
+---
+
+## Environment Availability
+
+| Dependency | Required by | Available | Version | Fallback |
+|---|---|---|---|---|
+| `rsvg-convert` | §3 PNG rasterization | ✓ | 2.60.0 | `inkscape --export-png` (also installed) or `convert` (ImageMagick) |
+| `pyftsubset` (fontTools) | §1, §6 WOFF2 subsetting | ✓ | 4.63.0 | `glyphhanger` (npm; would need install) |
+| `woff2_compress` | §1 WOFF2 encoding | ✓ | (system pkg) | bundled inside pyftsubset already; standalone tool is redundant |
+| `inkscape` | §3 SVG rendering | ✓ | 1.4.4 | — |
+| `convert` / `magick` | §3 SVG fallback | ✓ | (ImageMagick 7+, deprecated `convert` symlink) | — |
+| `python3` | §1 subsetting + smoke.sh URL encoding | ✓ | 3.x (per pyftsubset / smoke.sh hashbang) | — |
+| `node` | Vite build | ✓ | 24.14.0 | — |
+| `npm` (or pnpm/yarn) | Package management | ✓ | bundled with node | — |
+| `xmllint` / `brotli` | NOT required (pyftsubset bundles Brotli compression) | not checked | — | — |
+| Internet access (one-off, to fetch upstream IBM Plex + Newsreader releases) | §1 source TTFs | required at execute-plan time | — | Can curl from CDN as alternate (`https://fonts.gstatic.com/...` paths leaked from the Brief's bundler — uuid'd file names extractable from same source) |
+
+**Missing dependencies with no fallback:** None.
+
+**Missing dependencies with fallback:** None applicable.
+
+**Network requirement:** One-time download of TTF source files from GitHub Releases (IBM Plex ~30 MB; Newsreader ~10 MB). Within scope of any normal `curl`/`wget` step in execute-plan.
+
+---
+
+## Validation Architecture
+
+### Test Framework
+
+| Property | Value |
+|---|---|
+| Framework | `vitest` v4 |
+| Config file | none in repo root; vitest uses defaults (verified via `package.json:24`) |
+| Quick run command | `npx vitest run` |
+| Full suite command | `npx vitest run` (no separate full / quick distinction in current setup) |
+
+### Phase Requirements → Test Map
+
+| Req ID | Behavior | Test type | Automated command | File exists? |
+|---|---|---|---|---|
+| D-01 / D-06 | `icons/icon{16,48,128}.png` exist, are PNGs, clear size floors | unit (build artifact assertion) | `npx vitest run tests/build/icons-present.test.ts` | ❌ Wave 0 |
+| D-04 | `src/shared/tokens.css` exists; popup CSS @imports it; no `#2563eb`/`#dc2626` hex in popup CSS | unit (codebase grep) | `npx vitest run tests/build/tokens-adopted.test.ts` | ❌ Wave 0 |
+| D-05 + §1 R1 | `src/shared/fonts/IBMPlexSans-{Regular,Medium,SemiBold,Bold}.woff2` exist; `Newsreader-variable.woff2` exists; tokens.css `@font-face` rules match expected count | unit (filesystem + grep) | `npx vitest run tests/build/fonts-present.test.ts` | ❌ Wave 0 |
+| D-07 | `manifest.json:name === "__MSG_extName__"` AND `_locales/en/messages.json` has `extName.message === "Mokosh — Session Capture"` | unit (JSON parity) | `npx vitest run tests/i18n/manifest-i18n.test.ts` | ❌ Wave 0 |
+| D-08 | `manifest.json:description === "__MSG_extDesc__"`; `_locales/{en,ru}/messages.json` has `extDesc` with the tagline text | unit (JSON parity) | `npx vitest run tests/i18n/manifest-i18n.test.ts` | (same as D-07) |
+| D-09 | `dist/` after `npm run build` contains no file or content with `smoke`/`SMOKE` strings | integration (filesystem walk after build) | `npm run build && npx vitest run tests/build/no-smoke-in-dist.test.ts` | ❌ Wave 0 |
+| (i18n parity) | Every key in `_locales/ru/messages.json` exists in `_locales/en/messages.json` (the default_locale) | unit | `npx vitest run tests/i18n/locale-parity.test.ts` | ❌ Wave 0 |
+| (CSP) | Built `dist/src/shared/tokens.css` does not contain `fonts.googleapis.com` or any `https://` URL | unit | `npx vitest run tests/build/no-remote-fonts.test.ts` | ❌ Wave 0 |
+| (Operator manual) | After load-unpacked: extension name in `chrome://extensions` reads `"Mokosh — Session Capture"`; tooltip on hover reads RU sober string; popup renders in Plex Sans; SAVE button is madder-rust color | manual-only | (operator UAT) | n/a |
+
+### Sampling rate
+
+- **Per task commit:** `npx vitest run tests/build/*.test.ts tests/i18n/*.test.ts` (Plan 01-12-specific tests only; ~1–2 seconds).
+- **Per wave merge:** `npx vitest run && npm run build && npx tsc --noEmit` (full suite + build clean + types clean).
+- **Phase gate:** Full suite green + operator empirical (load extension, verify name + popup + tooltip + notification rendering, capture screenshots) before `/gsd-verify-work`.
+
+### Wave 0 gaps
+
+- [ ] `tests/build/icons-present.test.ts` — covers D-01 / D-06 PNG floors
+- [ ] `tests/build/tokens-adopted.test.ts` — covers D-04 token usage in popup CSS
+- [ ] `tests/build/fonts-present.test.ts` — covers D-05 + §1 R1 WOFF2 presence + count
+- [ ] `tests/i18n/manifest-i18n.test.ts` — covers D-07 + D-08 manifest:name/description shape + messages.json values
+- [ ] `tests/i18n/locale-parity.test.ts` — covers i18n key parity across locales
+- [ ] `tests/build/no-smoke-in-dist.test.ts` — covers D-09 (no-op-confirmation test)
+- [ ] `tests/build/no-remote-fonts.test.ts` — covers CSP migration in tokens.css
+- [ ] `tests/build/` directory may not exist yet — create it; convention matches existing `tests/{background,offscreen}/` structure.
+
+---
+
+## Security Domain
+
+### Applicable ASVS categories
+
+| ASVS category | Applies | Standard control |
+|---|---|---|
+| V2 Authentication | no | Plan 01-12 is brand integration; no auth surface |
+| V3 Session Management | no | No sessions introduced |
+| V4 Access Control | no | No new permission gates |
+| V5 Input Validation | yes (loosely) | i18n `messages.json` files are JSON; ensure JSON validity in CI (vitest `JSON.parse`) |
+| V6 Cryptography | no | No new crypto |
+| V12 File / Resources | yes | Self-hosted WOFF2 files MUST live under `src/shared/fonts/`; no `https://` URLs in `tokens.css`; Chrome MV3 CSP enforces this at runtime |
+| V14 Configuration | yes | `manifest.json:default_locale` set; `_locales/` directory complete; `web_accessible_resources` correctly auto-generated by @crxjs |
+
+### Known threat patterns for this stack
+
+| Pattern | STRIDE | Standard mitigation |
+|---|---|---|
+| Remote font load via `@import` (MV3 CSP violation) | Information Disclosure (font fingerprinting), Tampering (CDN MITM) | Self-host all fonts; explicitly assert no `https://` in built `tokens.css` via vitest |
+| Malformed PNG triggering Chrome `imageUtil` rejection (Plan 01-09 known issue) | Denial of Service (notification flow blocked) | PNG byte-size floor assertions in tests (`tests/build/icons-present.test.ts`); empirical UAT |
+| `_locales/` key tampering causing manifest validation failure | Denial of Service (extension fails to install) | JSON validity check in Wave 0 tests; manifest:name resolution test |
+| `__MSG_*__` injection from user-controllable input | Cross-Site Scripting (low surface; manifest fields don't render arbitrary user input) | Not applicable — `__MSG_*__` is engineering-authored, no user input flow |
+| WOFF2 with malicious OpenType tables | Code execution (historical browser CVEs) | Use upstream-distributed faces (IBM, Production Type); do not accept third-party fonts |
+
+---
+
+## Assumptions Log
+
+Every claim tagged `[ASSUMED]` in this research. The planner and discuss-phase should confirm these with the user before locking decisions that depend on them.
+
+| # | Claim | Section | Risk if wrong |
+|---|---|---|---|
+| A1 | `default_locale: "en"` is correct (Web Store convention) | §11 | If Mokosh is only distributed via Load Unpacked or operator-only channels, `"ru"` may be preferable. Low blast radius — flip the value, regenerate. |
+| A2 | The Russian "Сохранить отчёт об ошибке?" (label) + "Сохранить отчёт" (button) split per Brief §02 means DOM rework in `src/popup/` | §10 string #4 | If user prefers keeping the single-button form, the rework is unnecessary. Verify before executing. |
+| A3 | `src/shared/tokens.css` is the right path (vs `src/styles/tokens.css`) | "Claude's Discretion" + §9 | Low blast radius — rename, update 2–3 `@import` paths. |
+| A4 | A Cyrillic-capable serif fallback should be added to `--mks-font-display` stack for Russian display text (§1 R1) | §1 BLOCKER | If user accepts the OS-serif fallback for Russian (Times New Roman on Windows, Iowan Old Style on macOS), no Cyrillic serif font needs subsetting + bundling. Lower bundle size; lower visual consistency. |
+| A5 | `Newsreader-variable.woff2` covers the full italic + roman variable font range in a single file (Production Type's variable build may ship italic separately) | §1, §13 | If italic is a separate variable file, add a second `@font-face` rule with `font-style: italic;`. Verify at execute-plan time by downloading the actual release archive. |
+| A6 | The smoke page tokenization (§9 Option A) is "verbose but acceptable" — adds ~30 lines to smoke.sh's heredoc | §9 | If user thinks it's too noisy, fall back to Option C (leave smoke unstyled per tokens, accept the imperfection — smoke is dev-only). |
+| A7 | `BADGE_REC_COLOR` constant in `src/background/index.ts` should be updated to `#b2543d` (`--mks-madder-600`) with a comment cross-referencing the token | §10 / Anti-patterns | If user prefers keeping the existing material green, document the divergence between badge color and palette. The "dye reference" semantic of madder is the designer's intent per D-04. |
+
+If this table is empty, all claims in this research were verified or cited. **This table has 7 entries** — the planner should surface A1, A2, A4 in particular (highest-impact assumptions) during plan creation, ideally via the discussion log or as plan-level questions.
+
+---
+
+## Open Questions
+
+1. **D-05 Cyrillic for Newsreader** (BLOCKER per §1)
+   - What we know: Newsreader from upstream has no Cyrillic. Documented in Production Type repo and verified empirically in Decision Brief's @font-face subsets.
+   - What's unclear: User's preference among R1 (add Cyrillic-capable serif fallback), R2 (substitute display family), R3 (extend Newsreader — out of scope).
+   - Recommendation: Default to R1, add **PT Serif** as the Cyrillic fallback (OFL, ParaType, ~30 KB subsetted for RU); surface as a plan-level question.
+
+2. **D-07 wording for English manifest:name**
+   - What we know: User picked `"Mokosh — Session Capture"`.
+   - What's unclear: Should the EN messages.json `extName.message` exactly match the user's pick, or follow D-07 alt `"Mokosh / АИ Регистратор"` for transliteration support?
+   - Recommendation: Exact user pick (no transliteration). Lock as-stated unless user clarifies.
+
+3. **Plan 01-10 coordination**
+   - What we know: Plan 01-10 created `src/welcome/welcome.{html,ts,css}` with placeholder palette (`#00C853` green button, `#1f1f1f` text). Plan 01-12 wants to ingest tokens.
+   - What's unclear: Does Plan 01-12 rewire Plan 01-10's CSS now (single-pass token migration), or does Plan 01-12 leave Plan 01-10 alone and a future Plan 01-13 / 02-XX migrates welcome separately?
+   - Recommendation: Rewire in Plan 01-12. Welcome page is in Phase 1 scope; one-pass migration is cheaper than two-pass.
+
+4. **D-08 tagline wording mismatch**
+   - What we know: Brief §02 wrote `"Thirty seconds ago, always within reach."`; brand-decisions-v1.md wrote `"Thirty seconds ago, always at hand."`. Both attribute to D-08 user-accepted.
+   - What's unclear: Which exact wording for the EN parallel?
+   - Recommendation: Default to brand-decisions-v1.md (`"always at hand."`) as it's the more recent doc and reflects the user's final pick. Surface as a single confirmation question.
+
+5. **Plex Sans variable font availability**
+   - What we know: IBM published `@ibm/plex-sans-variable@0.2.0` (June 2024). The static per-weight files are also distributed.
+   - What's unclear: Whether the variable build is mature enough to replace the 4 static weights (which would shave ~80 KB).
+   - Recommendation: Use static per-weight files (Pattern A from §1) for the first pass. Migrate to variable in a future polish phase if bundle size matters.
+
+6. **Brief §02 string #4 popup-DOM rework**
+   - What we know: Brief splits "Сохранить отчёт об ошибке?" (label) from "Сохранить отчёт" (button).
+   - What's unclear: Single-button vs label+button.
+   - Recommendation: A2 in Assumptions Log. Default to single-button form; ask user during execute-plan if rework is wanted.
+
+---
+
+## Sources
+
+### Primary (HIGH confidence)
+
+- `tokens.css` (verified verbatim, all 281 lines read)
+- `mokosh-mark.svg`, `mokosh-lockup.svg` (verified verbatim)
+- `manifest.json`, `vite.config.ts`, `package.json` (codebase-verified)
+- `src/popup/index.html`, `src/popup/index.ts`, `src/popup/style.css`, `src/background/index.ts` lines 45, 54, 766–768 (codebase-verified)
+- `smoke.sh` (codebase-verified)
+- `.planning/intel/brand-decisions-v1.md` (verbatim read)
+- `.planning/intel/assets-spec.md` (verbatim read)
+- Decision Brief embedded `@font-face` declarations (extracted via Python JSON-decode, see tool-results)
+- Decision Brief §02 8 copy strings (extracted verbatim)
+- Local empirical: `rsvg-convert` rasterization verified at 16/48/128 px
+- Local empirical: `pyftsubset` + `woff2_compress` installed + working
+- [@crxjs/vite-plugin README on GitHub](https://github.com/crxjs/chrome-extension-tools/blob/main/packages/vite-plugin/README.md)
+- [Chrome i18n API docs](https://developer.chrome.com/docs/extensions/reference/api/i18n)
+- [Manifest default_locale docs](https://developer.chrome.com/docs/extensions/mv3/manifest/default_locale/)
+- [Vite Static Asset Handling](https://vite.dev/guide/assets)
+- [Vite env vars and modes](https://vite.dev/guide/env-and-mode)
+- [SIL Open Font License 1.1](https://openfontlicense.org/) + [OFL-FAQ](https://openfontlicense.org/ofl-faq/)
+- [IBM Plex repo](https://github.com/IBM/plex)
+- [Newsreader repo (productiontype/Newsreader)](https://github.com/productiontype/Newsreader)
+- [fontTools pyftsubset docs](https://fonttools.readthedocs.io/en/stable/subset/)
+
+### Secondary (MEDIUM confidence)
+
+- [Markos Konstantopoulos on font subsetting](https://markoskon.com/creating-font-subsets/)
+- [Walter Ebert on subsetting web fonts](https://walterebert.com/blog/subsetting-web-fonts/)
+- [Stefan Van Damme: i18n MV3 tutorial (2023)](https://www.stefanvd.net/blog/2023/04/24/how-to-add-internationalization-i18n-chrome-extension/)
+
+### Tertiary (LOW confidence — flagged)
+
+- WebSearch's initial claim that "Newsreader supports Cyrillic" — **contradicted by primary sources** (Decision Brief subsets, Production Type repo README). Resolved as BLOCKER §1.
+- WebSearch claim about Chrome notification icon 3:2 ratio and `imageUtil` floors — official docs don't document these; empirical Plan 01-09 finding is the only confirmed reference (`assets-spec.md:72`). The 1024-byte floor is verified by Plan 01-09 ops; not in any docs page.
+
+---
+
+## Metadata
+
+**Confidence breakdown:**
+
+- Standard stack: **HIGH** — all tools verified locally; versions checked via `--version` and `npm view`.
+- Architecture (tokens.css integration, @crxjs WAR auto-gen): **HIGH** — codebase + official docs.
+- WOFF2 self-hosting for Plex faces: **HIGH** — canonical subset structure verified from Decision Brief.
+- WOFF2 for Newsreader: **MEDIUM** — Latin-only subset is well-documented; Cyrillic handling required §1 BLOCKER resolution.
+- i18n via `__MSG_*__`: **HIGH** — official docs + repo + 2023 tutorial concur.
+- PNG rasterization: **HIGH** — locally empirically verified rsvg-convert at 16/48/128.
+- Smoke gating (D-09): **HIGH** — codebase grep + smoke.sh inspection confirm no-op status.
+- Notification icon floors (1024 B): **MEDIUM** — official docs don't document; relies on Plan 01-09 empirical finding.
+- Operator string i18n migration: **HIGH** — strings verbatim from Brief §02; call sites grep-verified.
+
+**Research date:** 2026-05-17
+
+**Valid until:** ~30 days (2026-06-16) for stable claims (font upstreams, OFL, Chrome i18n API). 7 days for cutting-edge claims (`@crxjs/vite-plugin@2.4.0`, IBM Plex variable v0.2.0 maturity).