1 · The rail is chrome, not a surface. It is painted from --console-rail-* and stays dark in both themes; its tier accent comes from --console-rail-tier-*. Nothing on the rail may reach for --tier, --tier-ink or the --ink ramp — those flip with the theme and the rail does not, so --tier-ink would land at 1.4:1 on the rail in light. The active nav item is marked by fill, border and label colour; there is no coloured side-stripe anywhere on this page.
2 · Read-only means read-only. This tier sits above coordinator operations and holds no exchange, no document and no fund. Nothing here initiates a disbursement, adjusts a statutory date, clears a KYC check or requests a signature — the widgets report, the office console acts. Adding a widget can never widen access: every widget and pinned view inherits the viewer's existing read scope, and dashboard reads are audit-logged like every other access on this tier.
3 · Deadline colour is earned, never decorative. Red and amber appear only on the two nearest deadline buckets and on the ≤ 7-day count. The concentration heatmap is violet — density, not danger — because a busy week is not a late week. An overdue clock must never render in a satisfied or neutral state anywhere this data is re-used.
4 · Four-eyes is reported as a fact, not a target. The governance panel states 12 of 12 dual-approved and names the 2 still awaiting a second approver. Approver ≠ proposer is enforced in the disbursement workflow, not by this surface; the count here must read from the same audit events, never from a separate tally.
5 · Layouts persist server-side, per user. One layout per QI Hub user, stored on the profile — never localStorage. Share with QI Hub team offers this layout as a named starting point and never overwrites anyone's saved layout; Reset to default restores the org default.
6 · Chart rules. One primary series in --tier against a --series-muted comparison series; every axis starts at zero with labelled gridlines; the heatmap holds four intensity steps rather than five, because a fifth step cannot carry a legible numeral in both themes. Counts are counts — funds throughput shows movements, never amounts.
7 · The controls in this mockup are spans; in code they are buttons. The kebab menus, layout chip, dialog tabs, type chips, pin rows, drag handles and close buttons must ship as real <button> elements with accessible names, so the keyboard and screen-reader paths exist and the shared :focus-visible ring applies. The hover and active states are already defined here.
8 · The tier's name is one token. Every occurrence of "QI Hub" renders through .tier-name — sidebar badge, breadcrumb, page badge, empty-state copy. A future rename drops in there and nowhere else.
Fully tokenized against ../tokens.css — no raw hex, in the stylesheet or in any inline style attribute. Light and dark are both designed. --tier, --tier-2, --series-muted, --scrim and the --console-rail-* family are [PROPOSED]: add them to packages/web-app/src/index.css in :root and .dark before writing a call site. All names, figures and references are synthetic demo data.