Split 300-line files into focused modules (Phase 7.2)

.claude/settings.local.json

@@ -101,7 +101,9 @@
       "Bash(claude plugin *)",
       "Bash(cp \"/root/.claude/uploads/995af0a3-e865-5b96-b002-e90985880970/cc51b77a-spec01codebaseauditandarchitecture.md\" \"/home/user/loki/docs/adr/spec-01-codebase-audit-and-architecture.md\" && echo \"placed\" && ls -la docs/adr/spec-01-codebase-audit-and-architecture.md)",
       "mcp__code-review-graph__list_graph_stats_tool",
-      "mcp__Claude_Code_Remote__send_later"
+      "mcp__Claude_Code_Remote__send_later",
+      "mcp__code-review-graph__refactor_tool",
+      "mcp__code-review-graph__build_or_update_graph_tool"
     ]
   },
   "enableAllProjectMcpServers": true,

.github/workflows/rust.yml

@@ -34,6 +34,9 @@ jobs:
     - name: File-ceiling gate (300-line ratchet)
       # Spec 01 audit A-2. New files <= 300 lines; baselined debt may not grow.
       run: python3 scripts/check-file-ceiling.py
+    - name: Suppression ratchet (`let _ =` swallows + `#[allow]`)
+      # Audit Q-3/Q-4. Per-file counts may only shrink; new files start at 0/0.
+      run: python3 scripts/check-suppressions.py
     - name: TODO-format gate (TODO(<topic>) tags)
       # Spec 01 audit A-11. No bare TODO / FIXME / HACK / XXX in production code.
       run: python3 scripts/check-todo-format.py

CLAUDE.md

@@ -205,7 +205,7 @@ baseline). Three techniques (the third added 2026-07-08):
 
 | File | Current lines | Priority |
 |---|---|---|
-| `loki-layout/src/para.rs` | 1447 | High |
+| `loki-layout/src/para.rs` | 1401 | High |
 | `loki-layout/src/flow.rs` | 1202 | High |
 | `loki-spreadsheet/src/routes/editor/editor_inner.rs` | 1014 | High |
 | `loki-ooxml/src/docx/write/document.rs` | 902 | High |
@@ -256,7 +256,9 @@ yet reach `0.41`:
 
 None of these are fixable by bumping our own `Cargo.toml` requirements — each is
 gated behind an upstream crate release that hasn't caught up to `quick-xml`
-0.41 yet. `object_store` is the one with real untrusted-network exposure and is
+0.41 yet. Re-checked 2026-07-11: still true — `object_store` 0.14.0 (latest)
+still requires `quick-xml ^0.40.1`. (The same pass fixed the unrelated
+RUSTSEC-2026-0204 by bumping `crossbeam-epoch` 0.9.18 → 0.9.20 in the lockfile.) `object_store` is the one with real untrusted-network exposure and is
 worth re-checking most often. Re-run `cargo audit` (or
 `cargo tree -i quick-xml`) periodically and bump `object_store` /
 `wayland-scanner`'s dependents the moment a release satisfies `quick-xml
@@ -472,7 +474,13 @@ Read in any descendant component:
 let theme = use_theme();
 ```
 
-Only `ThemeVariant::Dark` is implemented. Light theme tokens are deferred.
+Both variants are implemented (4c.4): `ThemePalette::dark()` / `light()` in
+`tokens/palette.rs`; the `COLOR_*` constants remain the dark values, so
+unmigrated components render dark under either variant. Components migrate by
+reading `use_theme().palette()` (Signal-backed — re-colors live on
+`AtThemeContext::toggle`, exposed as the tab-bar theme-toggle button). Shell
+chrome (title/tab/status bars, dialogs) is migrated; deep editor surfaces
+migrate opportunistically.
 
 ### What does NOT belong in `appthere_ui`
 

appthere-canvas/src/font_cache.rs

@@ -16,7 +16,7 @@ use std::sync::Arc;
 #[derive(Default)]
 pub struct FontDataCache {
     entries: HashMap<(usize, u32), peniko::FontData>,
-    coords: HashMap<(usize, u32), Vec<read_fonts::types::F2Dot14>>,
+    coords: HashMap<(usize, u32), Vec<i16>>,
 }
 
 #[cfg(feature = "font-cache")]
@@ -40,19 +40,19 @@ impl FontDataCache {
         })
     }
 
-    /// Returns the cached normalized coordinates (defaulting to zero) for the font's axes.
-    pub fn get_coords(
-        &mut self,
-        data: &Arc<Vec<u8>>,
-        font_index: u32,
-    ) -> &[read_fonts::types::F2Dot14] {
+    /// Returns the cached normalized coordinates (defaulting to zero) for the
+    /// font's axes, in `F2Dot14` bit representation — the form
+    /// `DrawGlyphs::normalized_coords` consumes, so per-glyph-run callers need
+    /// no conversion allocation.
+    pub fn get_coords(&mut self, data: &Arc<Vec<u8>>, font_index: u32) -> &[i16] {
         let key = (Arc::as_ptr(data) as usize, font_index);
         self.coords.entry(key).or_insert_with(|| {
             if let Ok(font_ref) = read_fonts::FontRef::from_index(data, font_index) {
                 use read_fonts::TableProvider;
                 if let Ok(fvar) = font_ref.fvar() {
                     if let Ok(axes) = fvar.axes() {
-                        return vec![read_fonts::types::F2Dot14::default(); axes.len()];
+                        // Default (all-zero) normalized position on every axis.
+                        return vec![0i16; axes.len()];
                     }
                 }
             }

appthere-conformance/Cargo.toml

@@ -19,6 +19,8 @@ sheet-model = ["dep:loki-sheet-model"]
 
 [dependencies]
 thiserror = { workspace = true }
+# The corpus vocabulary (catalog cases, fixture metadata) serializes into reports.
+serde = { version = "1", features = ["derive"] }
 # Round-trip the candidate XML through a temp file for `xmllint` validation.
 tempfile = "3"
 # PNG decode/encode for the visual-goldens differ and heatmap emission.

loki-acid/src/catalog/docx.rs → appthere-conformance/src/corpus/catalog/docx.rs

@@ -3,8 +3,8 @@
 
 //! DOCX acid cases (TEST_PLAN.md §1).
 
-use super::{Format::Docx, TestCase, tc};
-use crate::severity::Severity::{P0, P1, P2};
+use crate::corpus::Severity::{P0, P1, P2};
+use crate::corpus::{Format::Docx, TestCase, tc};
 
 /// The 38 DOCX test cases.
 pub(super) const CASES: &[TestCase] = &[