I3795 — A surface links to another surface and never embeds it

○READY wave 0 · p2 · implementation profile · parallel safe

Part of one-kit-on-every-surface — Code, charts, controls, embeds and shell blocks are one kit on every surface, declared in the design book and held there by a gate.

Objective

State in the design book that one surface reaches another by a link (the site to the published /ui and /cockpit snapshots, for example) and never by an iframe, embed or object, and add an audit rule that refuses those elements on every surface.

Why

On 2026-10-20 no iframe, embed or object existed on any surface, and nothing kept it so: an embedded surface would carry its own navigation, theme and language inside another's and escape the audits of both.

Current state

No embeds; the snapshots are linked (pages.yaml); Mermaid diagrams render inline on the site through diagrams.js.

Desired state

The design book's embed section says link, not embed; ui-audit rule embed.forbidden fails any iframe, embed or object on the site, /ui and the Cockpit.

Scope

• docs/DESIGN_SYSTEM.md
• scripts/lib/ui-audit.mjs
• scripts/lib/ui.test.mjs

Dependencies

None. This issue is a root of the graph.

Acceptance criteria

• ui-audit fails a page carrying an iframe, embed or object, naming the page and the element
• Every surface passes the rule on master

Validation

• bin/majordomus plan validate
• node scripts/lib/ui.test.mjs

Evidence required

• embed_forbidden_rule_test

Evidence

None recorded. Every token above needs a command or an artifact behind it before this issue can be completed; narrative is refused.

Timeline

started

—

verified

—

completed

—

Those three fields, the evidence above and the state of the dependencies are all the status is made of. There is no status field to disagree with them.

Canonical record: .ai/repo/project/issues/I3795.yaml. Read it back with majordomus plan show I3795.