1 · Tokens, never hex. Every colour on this surface resolves from docs/mockups/tokens.css. When this is coded, the [PROPOSED] tokens (--console-rail-*, --admin-*, the good/warn/bad triad) go into packages/web-app/src/index.css under :root and .dark first — never inlined at the call site. Light and dark are both designed here.
2 · The nav rail is chrome, not a themed surface. It stays dark navy in both themes, so anything painted on it draws from --console-rail-* and is measured against the rail fill. The rail's own ink ramp bottoms out at 4.7:1 — never reach into --ink-4 for rail text.
3 · The signing secret is shown in full exactly once. The stored value is a hash; the panel renders a masked prefix/suffix. Reveal, Copy and Rotate each write an audit-log entry with actor, timestamp and IP — the copy on the surface states this, so the implementation must actually emit it.
4 · Rotation is additive, never destructive. Issuing a new secret leaves the prior one valid for 24 hours so the CRM can cut over without dropping events. A rotation that invalidates immediately is a defect, not a stricter setting.
5 · Inbound events are verified before they are trusted. Every request is HMAC-SHA256 signature-checked against the tenant's secret and rejected on failure — the Rejected row in the activity log is a real outcome, not decoration. Pausing intake queues events rather than dropping them.
6 · Intake creates a queued file, never an active exchange. A CRM payload lands in the intake queue for a coordinator to accept. It cannot assign a coordinator, clear KYC, or start any statutory clock — identity screening remains the first gate on every file and no integration may mark it satisfied.
7 · Field mapping is per-tenant configuration held in the database, not localStorage and not a build-time constant. Auto-mapped and manually-mapped are distinguished in the UI because only one of them is safe to re-derive when the payload shape changes.
All names, references, endpoints and secrets on this surface are synthetic demo data.