diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..833596b
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,55 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+env:
+  CARGO_TERM_COLOR: always
+  RUSTFLAGS: -D warnings
+
+jobs:
+  lint:
+    name: Lint
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          components: rustfmt, clippy
+      - uses: Swatinem/rust-cache@v2
+      # Bevy's wayland/x11/udev features pull crates whose build.rs runs
+      # pkg-config; clippy still drives those build scripts even though it
+      # doesn't link, so the lint job needs the same system libs as test.
+      - name: Install Linux deps for Bevy
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y libasound2-dev libudev-dev libwayland-dev libxkbcommon-dev
+      - name: rustfmt
+        run: cargo fmt --all -- --check
+      - name: clippy
+        run: cargo clippy --workspace --all-targets -- -D warnings
+
+  test:
+    name: Test (${{ matrix.os }})
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+      - uses: Swatinem/rust-cache@v2
+      - name: Install Linux deps for Bevy
+        if: matrix.os == 'ubuntu-latest'
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y libasound2-dev libudev-dev libwayland-dev libxkbcommon-dev xvfb at-spi2-core
+      - name: cargo test (headless via xvfb on Linux)
+        if: matrix.os == 'ubuntu-latest'
+        run: xvfb-run -a cargo test --workspace
+      - name: cargo test (macOS / Windows)
+        if: matrix.os != 'ubuntu-latest'
+        run: cargo test --workspace
diff --git a/.gitignore b/.gitignore
index 05787f3..988010f 100644
--- a/.gitignore
+++ b/.gitignore
@@ -3,3 +3,8 @@
 .claude/worktrees/
 
 .worktrees/
+
+.superpowers/
+
+target/
+Cargo.lock
diff --git a/Cargo.toml b/Cargo.toml
new file mode 100644
index 0000000..486f044
--- /dev/null
+++ b/Cargo.toml
@@ -0,0 +1,47 @@
+[package]
+name = "buiy_workspace"
+version = "0.0.1"
+edition = "2024"
+license = "MIT OR Apache-2.0"
+publish = false
+description = "Workspace root package; exists only to host workspace-level integration tests."
+
+[lib]
+path = "src/lib.rs"
+
+[dev-dependencies]
+bevy = { workspace = true, features = ["bevy_render", "bevy_winit", "x11", "wayland"] }
+buiy = { path = "crates/buiy" }
+buiy_core = { path = "crates/buiy_core" }
+buiy_verify = { path = "crates/buiy_verify" }
+
+[workspace]
+resolver = "2"
+members = [
+    "crates/buiy",
+    "crates/buiy_core",
+    "crates/buiy_widgets",
+    "crates/buiy_verify",
+    "examples/hello_button",
+]
+
+[workspace.package]
+version = "0.0.1"
+edition = "2024"
+license = "MIT OR Apache-2.0"
+repository = "https://github.com/intendednull/buiy"
+rust-version = "1.85"
+
+[workspace.dependencies]
+# Phase 0 keeps the workspace dep set minimal: only crates that have a
+# `use` in `src/` are listed. Speculative deps (accesskit, accesskit_winit,
+# bevy_picking backend, image-compare for SSIM, thiserror for typed errors)
+# return when the consuming task lands. See review notes in
+# docs/plans/2026-05-07-buiy-phase-0-foundations.md.
+bevy = { version = "0.18", default-features = false, features = ["bevy_render", "bevy_core_pipeline", "bevy_winit", "bevy_window", "bevy_asset", "bevy_log", "x11", "wayland"] }
+taffy = "0.10"
+serde = { version = "1", features = ["derive"] }
+serde_json = "1"
+image = "0.25"
+proptest = "1"
+tracing = "0.1"
diff --git a/clippy.toml b/clippy.toml
new file mode 100644
index 0000000..5539ef0
--- /dev/null
+++ b/clippy.toml
@@ -0,0 +1 @@
+disallowed-methods = []
diff --git a/crates/buiy/Cargo.toml b/crates/buiy/Cargo.toml
new file mode 100644
index 0000000..2326148
--- /dev/null
+++ b/crates/buiy/Cargo.toml
@@ -0,0 +1,13 @@
+[package]
+name = "buiy"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+repository.workspace = true
+rust-version.workspace = true
+description = "A comprehensive UI library for Bevy with web-quality accessibility."
+
+[dependencies]
+bevy.workspace = true
+buiy_core = { path = "../buiy_core" }
+buiy_widgets = { path = "../buiy_widgets" }
diff --git a/crates/buiy/src/lib.rs b/crates/buiy/src/lib.rs
new file mode 100644
index 0000000..222a45a
--- /dev/null
+++ b/crates/buiy/src/lib.rs
@@ -0,0 +1,83 @@
+//! Buiy — comprehensive UI library for Bevy.
+//!
+//! See: docs/specs/2026-05-07-buiy-foundation/README.md.
+
+use bevy::prelude::*;
+
+pub use buiy_core::{
+    BuiySet, CorePlugin,
+    a11y::{A11yDescription, A11yLabel, A11yRole, A11yTreeBuilder},
+    components::{FlexDirection, Node, ResolvedLayout, Style},
+    focus::{FocusVisible, Focusable, FocusedEntity},
+    picking::Hovered,
+    theme::{Theme, UserPreferences, default_light_theme},
+};
+pub use buiy_widgets::{Button, OnPress, WidgetsPlugin};
+
+// `buiy_core::render::ExtractedDraws` is intentionally NOT re-exported at
+// the crate root: it is a render-world resource only, populated during the
+// extract phase. Main-world consumers reading it would see an empty Vec.
+// Render-world plugin authors who need it can reach `buiy::buiy_core::render`
+// (or depend on `buiy_core` directly) without crate-root surface pollution.
+
+/// Top-level Buiy plugin. Composes sub-plugins in the documented order:
+/// core → theme → a11y → focus → input → widgets. Render registration
+/// happens in `Plugin::finish` so RenderApp exists when we reach it.
+///
+/// See: docs/specs/2026-05-07-buiy-foundation/architecture.md § 2.8.
+///
+/// # Required Bevy plugins
+///
+/// `BuiyPlugin` requires `bevy::input::InputPlugin`. `DefaultPlugins`
+/// includes it; if you build your app with `MinimalPlugins`, add it
+/// explicitly:
+///
+/// ```ignore
+/// App::new()
+///     .add_plugins(MinimalPlugins)
+///     .add_plugins(bevy::input::InputPlugin)
+///     .add_plugins(BuiyPlugin)
+///     .run();
+/// ```
+///
+/// `FocusPlugin::handle_tab` reads `Res<ButtonInput<KeyCode>>` and the
+/// `Button` click handler reads `Res<ButtonInput<MouseButton>>`. Bevy
+/// 0.18 panics when a `Res<T>` system param is missing, so the plugin
+/// must be present.
+///
+/// # Plugin order
+///
+/// Add `BuiyPlugin` **after** Bevy's render plugin (i.e., after
+/// `DefaultPlugins`). `BuiyPlugin::finish` registers `BuiyRenderPlugin`,
+/// whose `build` reads `PipelineCache` — a resource that
+/// `RenderPlugin::finish` inserts. Plugin `finish` runs in registration
+/// order, so adding `BuiyPlugin` before `DefaultPlugins` flips the order
+/// and panics when `BuiyRenderPlugin` reaches for the missing
+/// `PipelineCache`.
+pub struct BuiyPlugin;
+
+impl Plugin for BuiyPlugin {
+    fn build(&self, app: &mut App) {
+        // Sub-plugin order matches architecture.md § 2.8 documented order:
+        // core → theme → a11y → focus → input → text → widgets → ...
+        // Phase 0 omits text / animation / forms / devtools; LayoutPlugin
+        // and PickingPlugin (which aren't enumerated as sub-plugins in § 2.8
+        // because their work lives in BuiySet::Layout and BuiySet::Picking)
+        // are slotted between Focus and Widgets so widgets see resolved
+        // layout + hit-test results when they run in the same frame.
+        app.add_plugins((
+            CorePlugin,
+            buiy_core::theme::ThemePlugin,
+            buiy_core::a11y::A11yPlugin,
+            buiy_core::focus::FocusPlugin,
+            buiy_core::layout::LayoutPlugin,
+            buiy_core::picking::PickingPlugin,
+            WidgetsPlugin,
+        ));
+    }
+
+    fn finish(&self, app: &mut App) {
+        // RenderApp is guaranteed to exist by `finish` time.
+        app.add_plugins(buiy_core::render::BuiyRenderPlugin);
+    }
+}
diff --git a/crates/buiy/tests/plugin.rs b/crates/buiy/tests/plugin.rs
new file mode 100644
index 0000000..2b6dda7
--- /dev/null
+++ b/crates/buiy/tests/plugin.rs
@@ -0,0 +1,20 @@
+use bevy::prelude::*;
+use buiy::BuiyPlugin;
+
+#[test]
+fn buiy_plugin_loads_in_correct_order() {
+    let mut app = App::new();
+    app.add_plugins(MinimalPlugins);
+    // `BuiyPlugin` composes systems that read keyboard / pointer input
+    // (focus tab handling, button click). `MinimalPlugins` does not include
+    // `InputPlugin`, so we add it here so `app.update()` doesn't panic on
+    // missing `ButtonInput<KeyCode>` / `ButtonInput<MouseButton>` resources.
+    app.add_plugins(bevy::input::InputPlugin);
+    app.add_plugins(BuiyPlugin);
+    app.update();
+
+    // Sanity: re-exports are accessible.
+    let _ = std::any::TypeId::of::<buiy::Button>();
+    let _ = std::any::TypeId::of::<buiy::Focusable>();
+    let _ = std::any::TypeId::of::<buiy::A11yRole>();
+}
diff --git a/crates/buiy_core/Cargo.toml b/crates/buiy_core/Cargo.toml
new file mode 100644
index 0000000..8dd6717
--- /dev/null
+++ b/crates/buiy_core/Cargo.toml
@@ -0,0 +1,10 @@
+[package]
+name = "buiy_core"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+
+[dependencies]
+bevy.workspace = true
+taffy.workspace = true
+tracing.workspace = true
diff --git a/crates/buiy_core/src/a11y.rs b/crates/buiy_core/src/a11y.rs
new file mode 100644
index 0000000..1256071
--- /dev/null
+++ b/crates/buiy_core/src/a11y.rs
@@ -0,0 +1,101 @@
+//! AccessKit integration. Phase 0 builds an in-memory snapshot and exposes
+//! an `A11yTreeBuilder` that can be serialized for snapshot tests; the real
+//! `accesskit_winit::Adapter` wiring per-window happens once Bevy windows
+//! are introduced (Task 13, BuiyPlugin).
+//!
+//! See: docs/specs/2026-05-07-buiy-foundation/architecture.md § 2.6 and
+//! accessibility.md § 3.11 (decomposed components per #17644).
+
+use crate::{BuiySet, focus::Focusable};
+use bevy::prelude::*;
+
+/// Decomposed AccessKit role component.
+#[derive(Component, Reflect, Clone, Copy, Debug, PartialEq, Eq, Default)]
+#[reflect(Component)]
+pub enum A11yRole {
+    #[default]
+    Generic,
+    Button,
+    Link,
+    Image,
+    Text,
+    Heading,
+    Dialog,
+    AlertDialog,
+    Tooltip,
+    // Phase 0 stops here; full taxonomy is in the foundation spec accessibility.md.
+}
+
+/// Decomposed accessible name. ACCNAME 1.2 computation is in `buiy-accessibility-design`;
+/// Phase 0 is the literal-string fast path.
+#[derive(Component, Reflect, Clone, Debug, Default)]
+#[reflect(Component)]
+pub struct A11yLabel(pub String);
+
+/// Decomposed accessible description.
+#[derive(Component, Reflect, Clone, Debug, Default)]
+#[reflect(Component)]
+pub struct A11yDescription(pub String);
+
+/// One node in the tree as Buiy sees it. Will be translated into
+/// `accesskit::Node` by the adapter in Task 13. Decoupled here so we can
+/// snapshot it without needing a winit window.
+#[derive(Clone, Debug, PartialEq)]
+pub struct A11yNodeView {
+    pub entity: Entity,
+    pub role: A11yRole,
+    pub name: String,
+    pub description: String,
+    pub focusable: bool,
+}
+
+/// Tree builder: rebuilt each frame from changed components in BuiySet::A11yUpdate.
+#[derive(Resource, Default)]
+pub struct A11yTreeBuilder {
+    nodes: Vec<A11yNodeView>,
+}
+
+impl A11yTreeBuilder {
+    pub fn snapshot(&self) -> &[A11yNodeView] {
+        &self.nodes
+    }
+}
+
+pub struct A11yPlugin;
+
+impl Plugin for A11yPlugin {
+    fn build(&self, app: &mut App) {
+        app.register_type::<A11yRole>()
+            .register_type::<A11yLabel>()
+            .register_type::<A11yDescription>()
+            .init_resource::<A11yTreeBuilder>()
+            .add_systems(Update, build_tree.in_set(BuiySet::A11yUpdate));
+    }
+}
+
+#[allow(clippy::type_complexity)]
+fn build_tree(
+    mut builder: ResMut<A11yTreeBuilder>,
+    q: Query<(
+        Entity,
+        Option<&A11yRole>,
+        Option<&A11yLabel>,
+        Option<&A11yDescription>,
+        Option<&Focusable>,
+    )>,
+) {
+    builder.nodes.clear();
+    for (entity, role, label, desc, focusable) in q.iter() {
+        // Skip entities that have no a11y content at all.
+        if role.is_none() && label.is_none() && desc.is_none() && focusable.is_none() {
+            continue;
+        }
+        builder.nodes.push(A11yNodeView {
+            entity,
+            role: role.copied().unwrap_or_default(),
+            name: label.map(|l| l.0.clone()).unwrap_or_default(),
+            description: desc.map(|d| d.0.clone()).unwrap_or_default(),
+            focusable: focusable.is_some(),
+        });
+    }
+}
diff --git a/crates/buiy_core/src/components.rs b/crates/buiy_core/src/components.rs
new file mode 100644
index 0000000..642f4c6
--- /dev/null
+++ b/crates/buiy_core/src/components.rs
@@ -0,0 +1,58 @@
+//! Buiy's core component types.
+//!
+//! Every Buiy component is small, public-fielded, observable, and decomposed
+//! by concern. Every component derives `Reflect + Default + Clone + Component`
+//! (and Bevy 0.18's `Reflect` derive auto-generates `FromReflect`). See:
+//! docs/specs/2026-05-07-buiy-foundation/architecture.md § 2.4.
+
+use bevy::prelude::*;
+
+/// Flex layout direction. Mirrors Taffy's `FlexDirection` for the
+/// row / column subset used in Phase 0; v0.x layout-design will widen
+/// this to include `RowReverse` / `ColumnReverse` when needed.
+#[derive(Reflect, Default, Clone, Copy, Debug, PartialEq, Eq)]
+pub enum FlexDirection {
+    #[default]
+    Row,
+    Column,
+}
+
+/// A Buiy node — the parallel-to-bevy_ui::Node primitive. Marker that this
+/// entity participates in Buiy's layout / render / a11y trees.
+#[derive(Component, Reflect, Default, Clone, Debug)]
+#[reflect(Component)]
+pub struct Node;
+
+/// Box-model + layout style. Not exhaustive in Phase 0 — only the surface
+/// the layout system reads.
+#[derive(Component, Reflect, Default, Clone, Debug)]
+#[reflect(Component)]
+pub struct Style {
+    /// Width in logical pixels. 0.0 = auto.
+    pub width: f32,
+    /// Height in logical pixels. 0.0 = auto.
+    pub height: f32,
+    /// Padding on all sides.
+    pub padding: f32,
+    /// Margin on all sides.
+    pub margin: f32,
+    /// Border radius (uniform; per-corner is a later sub-spec).
+    pub border_radius: f32,
+    /// Flex direction. Mapped to Taffy in `layout.rs`.
+    pub flex_direction: FlexDirection,
+    /// Token reference for background color (e.g., "color.surface.primary").
+    pub background_token: String,
+    /// Token reference for foreground/text color.
+    pub foreground_token: String,
+}
+
+/// Resolved layout output, written by the layout system in `BuiySet::Layout`.
+/// Read by render and picking in subsequent sets.
+#[derive(Component, Reflect, Default, Clone, Debug)]
+#[reflect(Component)]
+pub struct ResolvedLayout {
+    /// Top-left position in logical pixels (window-relative).
+    pub position: Vec2,
+    /// Size in logical pixels.
+    pub size: Vec2,
+}
diff --git a/crates/buiy_core/src/focus.rs b/crates/buiy_core/src/focus.rs
new file mode 100644
index 0000000..7117254
--- /dev/null
+++ b/crates/buiy_core/src/focus.rs
@@ -0,0 +1,110 @@
+//! Focus model: focus tree, Tab handling, focus-visible heuristic, focus
+//! restoration. Phase 0 implements ordered Tab traversal; full focus tree
+//! (roving tabindex, aria-activedescendant, traps, restoration, spatial nav)
+//! lives in `buiy-focus-model-design`.
+//!
+//! See: docs/specs/2026-05-07-buiy-foundation/architecture.md § 2.3 and
+//! accessibility.md (Focus management).
+//!
+//! # Phase 0 deferred behavior
+//!
+//! - **Auto tab order is `entity.index()`-based, not full "document order".**
+//!   Bevy reuses entity indices after despawn; for two `Focusable`s with
+//!   `tab_order = 0`, the resolved order depends on entity-index allocation,
+//!   not insertion order. Insertion-order stability is owned by
+//!   `buiy-focus-model-design`.
+//! - **`FocusVisible` is set to `true` on Tab and never reset to `false`.**
+//!   Pointer-driven focus paths (which clear `FocusVisible`) live in
+//!   `buiy-focus-model-design`; Phase 0 is keyboard-only so the always-true
+//!   state is correct for Phase 0 consumers.
+//! - **Shift detection covers `ShiftLeft`/`ShiftRight` only.** Sticky-keys /
+//!   accessibility-shell remappings of Shift to other key codes are out of
+//!   scope; full key-binding abstraction lives in `buiy-input-events-design`.
+
+use crate::BuiySet;
+use bevy::prelude::*;
+
+/// Marks an entity as part of the focus tree.
+#[derive(Component, Reflect, Default, Clone, Debug)]
+#[reflect(Component)]
+pub struct Focusable {
+    /// Phase 0: 0 = Auto (in document order); negative = Skip; positive = explicit.
+    pub tab_order: i32,
+}
+
+/// Currently focused entity (None = nothing focused).
+#[derive(Resource, Reflect, Default, Clone, Debug)]
+#[reflect(Resource)]
+pub struct FocusedEntity(pub Option<Entity>);
+
+/// Tracks whether the most recent focus change was keyboard / programmatic
+/// (true) or pointer (false). Drives the `:focus-visible` heuristic — focus
+/// rings render only when this is true.
+#[derive(Resource, Reflect, Default, Clone, Debug)]
+#[reflect(Resource)]
+pub struct FocusVisible(pub bool);
+
+pub struct FocusPlugin;
+
+impl Plugin for FocusPlugin {
+    fn build(&self, app: &mut App) {
+        app.register_type::<Focusable>()
+            .register_type::<FocusedEntity>()
+            .register_type::<FocusVisible>()
+            .init_resource::<FocusedEntity>()
+            .init_resource::<FocusVisible>()
+            .add_systems(Update, handle_tab.in_set(BuiySet::Input));
+    }
+}
+
+fn handle_tab(
+    keys: Res<ButtonInput<KeyCode>>,
+    focusables: Query<(Entity, &Focusable)>,
+    mut focused: ResMut<FocusedEntity>,
+    mut visible: ResMut<FocusVisible>,
+) {
+    let pressed_tab = keys.just_pressed(KeyCode::Tab);
+    if !pressed_tab {
+        return;
+    }
+    let forward = !keys.pressed(KeyCode::ShiftLeft) && !keys.pressed(KeyCode::ShiftRight);
+    advance_focus(&focusables, &mut focused, forward);
+    visible.0 = true;
+}
+
+fn advance_focus(
+    focusables: &Query<(Entity, &Focusable)>,
+    focused: &mut FocusedEntity,
+    forward: bool,
+) {
+    let entries: Vec<(Entity, Focusable)> =
+        focusables.iter().map(|(e, f)| (e, f.clone())).collect();
+    focused.0 = compute_next_focus(&entries, focused.0, forward);
+}
+
+fn compute_next_focus(
+    focusables: &[(Entity, Focusable)],
+    current: Option<Entity>,
+    forward: bool,
+) -> Option<Entity> {
+    let mut entries: Vec<(Entity, Focusable)> = focusables
+        .iter()
+        .filter(|(_, f)| f.tab_order >= 0)
+        .cloned()
+        .collect();
+    if entries.is_empty() {
+        return None;
+    }
+    // Sort: explicit positive tab_order first (ascending), then Auto (0) in document order.
+    entries.sort_by_key(|(e, f)| (if f.tab_order > 0 { 0 } else { 1 }, f.tab_order, e.index()));
+
+    let idx = current.and_then(|e| entries.iter().position(|(x, _)| *x == e));
+    let n = entries.len();
+    let next_idx = match (idx, forward) {
+        (None, true) => 0,
+        (None, false) => n - 1,
+        (Some(i), true) => (i + 1) % n,
+        (Some(i), false) => (i + n - 1) % n,
+    };
+    Some(entries[next_idx].0)
+}
diff --git a/crates/buiy_core/src/layout.rs b/crates/buiy_core/src/layout.rs
new file mode 100644
index 0000000..8e79aa1
--- /dev/null
+++ b/crates/buiy_core/src/layout.rs
@@ -0,0 +1,166 @@
+//! Layout via Taffy.
+//!
+//! See: docs/specs/2026-05-07-buiy-foundation/visuals.md § 3.2 and
+//! architecture.md § 2.3. Phase 0 supports flex row/column with fixed
+//! width/height; the full layout surface lives in `buiy-layout-design`.
+//!
+//! ## Why `NonSend`?
+//!
+//! Taffy 0.10 packs every `Dimension` into a tagged pointer
+//! (`*const ()`), which makes `TaffyTree` `!Send + !Sync` regardless of
+//! whether the `calc` feature is in use. Layout is inherently a
+//! single-threaded pass over the tree, so storing it as a non-send
+//! resource is both correct and free of `unsafe`.
+
+use crate::{
+    BuiySet,
+    components::{FlexDirection as BuiyFlexDirection, Node, ResolvedLayout, Style},
+};
+use bevy::prelude::*;
+use std::collections::HashMap;
+use taffy::{
+    AvailableSpace, Dimension, FlexDirection, NodeId as TaffyNodeId, Size, Style as TaffyStyle,
+    TaffyTree,
+};
+
+/// Maps Bevy `Entity` to Taffy node IDs. Reused across frames to keep
+/// Taffy's internal cache warm. Stored as a `NonSend` resource because
+/// Taffy's compact-length representation contains a `*const ()`.
+//
+// TODO(buiy-layout-design): garbage-collect entries when their `Entity`
+// is despawned. Currently `by_entity` and the underlying `TaffyTree`
+// grow monotonically across despawns. v0.x adds a `RemovedComponents<Node>`
+// reader system in `BuiySet::Layout` that drops the matching entries.
+#[derive(Default)]
+pub struct LayoutTree {
+    tree: TaffyTree<()>,
+    by_entity: HashMap<Entity, TaffyNodeId>,
+}
+
+pub struct LayoutPlugin;
+
+impl Plugin for LayoutPlugin {
+    fn build(&self, app: &mut App) {
+        app.init_non_send_resource::<LayoutTree>()
+            .add_systems(Update, sync_and_compute_layout.in_set(BuiySet::Layout));
+    }
+}
+
+fn style_to_taffy(style: &Style) -> TaffyStyle {
+    TaffyStyle {
+        size: Size {
+            width: if style.width > 0.0 {
+                Dimension::length(style.width)
+            } else {
+                Dimension::auto()
+            },
+            height: if style.height > 0.0 {
+                Dimension::length(style.height)
+            } else {
+                Dimension::auto()
+            },
+        },
+        flex_direction: match style.flex_direction {
+            BuiyFlexDirection::Row => FlexDirection::Row,
+            BuiyFlexDirection::Column => FlexDirection::Column,
+        },
+        ..Default::default()
+    }
+}
+
+/// One pass: ensure every Buiy entity has a Taffy node, sync style, compute
+/// layout starting from roots (entities with `Node` and no Buiy parent),
+/// write `ResolvedLayout` back.
+#[allow(clippy::type_complexity)]
+fn sync_and_compute_layout(
+    mut commands: Commands,
+    mut tree: NonSendMut<LayoutTree>,
+    nodes: Query<(Entity, &Style, Option<&ChildOf>, Option<&Children>), With<Node>>,
+    windows: Query<&bevy::window::Window>,
+) {
+    let tree = &mut *tree;
+
+    // Ensure every Buiy entity has a Taffy node + current style.
+    for (entity, style, _parent, _children) in nodes.iter() {
+        let taffy_style = style_to_taffy(style);
+        match tree.by_entity.get(&entity).copied() {
+            Some(id) => {
+                if let Err(err) = tree.tree.set_style(id, taffy_style) {
+                    warn!(?entity, ?err, "buiy: layout set_style failed");
+                }
+            }
+            None => match tree.tree.new_leaf(taffy_style) {
+                Ok(id) => {
+                    tree.by_entity.insert(entity, id);
+                }
+                Err(err) => {
+                    warn!(
+                        ?entity,
+                        ?err,
+                        "buiy: layout new_leaf failed; entity will be skipped this frame"
+                    );
+                }
+            },
+        }
+    }
+
+    // Sync child relationships for each Buiy entity.
+    for (entity, _style, _parent, children) in nodes.iter() {
+        let parent_id = match tree.by_entity.get(&entity).copied() {
+            Some(id) => id,
+            None => continue,
+        };
+        let child_ids: Vec<TaffyNodeId> = children
+            .into_iter()
+            .flatten()
+            .filter_map(|c| tree.by_entity.get(c).copied())
+            .collect();
+        if let Err(err) = tree.tree.set_children(parent_id, &child_ids) {
+            warn!(?entity, ?err, "buiy: layout set_children failed");
+        }
+    }
+
+    // Compute layout for roots (entities with Node and no Buiy parent).
+    let window_size = windows
+        .iter()
+        .next()
+        .map(|w| Vec2::new(w.width(), w.height()))
+        .unwrap_or(Vec2::new(800.0, 600.0));
+
+    for (entity, _style, parent, _children) in nodes.iter() {
+        let is_root = parent
+            .map(|p| !tree.by_entity.contains_key(&p.parent()))
+            .unwrap_or(true);
+        if !is_root {
+            continue;
+        }
+        if let Some(id) = tree.by_entity.get(&entity).copied()
+            && let Err(err) = tree.tree.compute_layout(
+                id,
+                Size {
+                    width: AvailableSpace::Definite(window_size.x),
+                    height: AvailableSpace::Definite(window_size.y),
+                },
+            )
+        {
+            warn!(?entity, ?err, "buiy: layout compute_layout failed");
+        }
+    }
+
+    // Walk the tree and write ResolvedLayout for every entity.
+    let mut to_write: Vec<(Entity, ResolvedLayout)> = Vec::new();
+    for (&entity, &id) in tree.by_entity.iter() {
+        if let Ok(layout) = tree.tree.layout(id) {
+            to_write.push((
+                entity,
+                ResolvedLayout {
+                    position: Vec2::new(layout.location.x, layout.location.y),
+                    size: Vec2::new(layout.size.width, layout.size.height),
+                },
+            ));
+        }
+    }
+    for (e, rl) in to_write {
+        commands.entity(e).insert(rl);
+    }
+}
diff --git a/crates/buiy_core/src/lib.rs b/crates/buiy_core/src/lib.rs
new file mode 100644
index 0000000..24c4f33
--- /dev/null
+++ b/crates/buiy_core/src/lib.rs
@@ -0,0 +1,60 @@
+//! Buiy core: components, plugin scaffolding, system sets.
+//!
+//! See: docs/specs/2026-05-07-buiy-foundation/architecture.md § 2.8 for
+//! sub-plugin order and SystemSet definitions.
+
+use bevy::prelude::*;
+
+pub mod a11y;
+pub mod components;
+pub mod focus;
+pub mod layout;
+pub mod picking;
+pub mod render;
+pub mod theme;
+
+pub use a11y::{A11yDescription, A11yLabel, A11yNodeView, A11yPlugin, A11yRole, A11yTreeBuilder};
+pub use components::{FlexDirection, Node, ResolvedLayout, Style};
+pub use focus::{FocusPlugin, FocusVisible, Focusable, FocusedEntity};
+pub use layout::LayoutPlugin;
+pub use picking::{Hovered, PickingPlugin, hit_test};
+
+/// Top-level system sets for Buiy. Order: Layout → Style → Input → Animate
+/// → Picking → A11yUpdate → Render.
+#[derive(SystemSet, Debug, Clone, Copy, Eq, PartialEq, Hash)]
+pub enum BuiySet {
+    Layout,
+    Style,
+    Input,
+    Animate,
+    Picking,
+    A11yUpdate,
+    Render,
+}
+
+/// Core Buiy plugin: registers types, configures system sets.
+/// Composed into `BuiyPlugin` from the meta-crate; not consumed directly
+/// by end users.
+pub struct CorePlugin;
+
+impl Plugin for CorePlugin {
+    fn build(&self, app: &mut App) {
+        app.register_type::<Node>()
+            .register_type::<Style>()
+            .register_type::<ResolvedLayout>()
+            .register_type::<FlexDirection>()
+            .configure_sets(
+                Update,
+                (
+                    BuiySet::Layout,
+                    BuiySet::Style,
+                    BuiySet::Input,
+                    BuiySet::Animate,
+                    BuiySet::Picking,
+                    BuiySet::A11yUpdate,
+                    BuiySet::Render,
+                )
+                    .chain(),
+            );
+    }
+}
diff --git a/crates/buiy_core/src/picking.rs b/crates/buiy_core/src/picking.rs
new file mode 100644
index 0000000..a583c88
--- /dev/null
+++ b/crates/buiy_core/src/picking.rs
@@ -0,0 +1,77 @@
+//! Buiy `bevy_picking` backend. Per-window registration; full backend
+//! priority + window filter live in `buiy-input-events-design`.
+//!
+//! See: docs/specs/2026-05-07-buiy-foundation/cross-cutting.md § 3.18.
+
+use crate::components::ResolvedLayout;
+use bevy::ecs::query::QueryState;
+use bevy::prelude::*;
+
+/// Phase 0 picking exposes a simple AABB hit-test fn for tests + a
+/// minimal Bevy system that updates a `Hovered` resource. The full
+/// `bevy_picking::backend::PickingBackend` registration lives in v0.x.
+pub struct PickingPlugin;
+
+#[derive(Resource, Reflect, Default, Clone, Debug)]
+#[reflect(Resource)]
+pub struct Hovered(pub Option<Entity>);
+
+impl Plugin for PickingPlugin {
+    fn build(&self, app: &mut App) {
+        app.register_type::<Hovered>()
+            .init_resource::<Hovered>()
+            .add_systems(Update, update_hovered.in_set(crate::BuiySet::Picking));
+    }
+}
+
+/// Free-function AABB hit-test for tests and library consumers. Operates
+/// on `&World` via `QueryState::try_new`, which returns `None` if the
+/// queried components are not yet registered (e.g., test set-up missed
+/// `CorePlugin`). In that case there can be no matching entities, so we
+/// return `None`.
+pub fn hit_test(world: &World, point: Vec2) -> Option<Entity> {
+    let mut state = QueryState::<(Entity, &ResolvedLayout)>::try_new(world)?;
+    let mut best: Option<(Entity, f32)> = None; // entity, area (smallest wins for top-most)
+    for (entity, layout) in state.iter(world) {
+        if point_in_aabb(point, layout) {
+            let area = layout.size.x * layout.size.y;
+            if best.map(|(_, a)| area < a).unwrap_or(true) {
+                best = Some((entity, area));
+            }
+        }
+    }
+    best.map(|(e, _)| e)
+}
+
+fn point_in_aabb(point: Vec2, layout: &ResolvedLayout) -> bool {
+    let max = layout.position + layout.size;
+    point.x >= layout.position.x
+        && point.x <= max.x
+        && point.y >= layout.position.y
+        && point.y <= max.y
+}
+
+fn update_hovered(
+    mut hovered: ResMut<Hovered>,
+    windows: Query<&Window>,
+    layouts: Query<(Entity, &ResolvedLayout)>,
+) {
+    let Some(window) = windows.iter().next() else {
+        return;
+    };
+    let Some(cursor) = window.cursor_position() else {
+        hovered.0 = None;
+        return;
+    };
+    // Inline hit_test against the live query to avoid needing &World.
+    let mut best: Option<(Entity, f32)> = None;
+    for (entity, layout) in layouts.iter() {
+        if point_in_aabb(cursor, layout) {
+            let area = layout.size.x * layout.size.y;
+            if best.map(|(_, a)| area < a).unwrap_or(true) {
+                best = Some((entity, area));
+            }
+        }
+    }
+    hovered.0 = best.map(|(e, _)| e);
+}
diff --git a/crates/buiy_core/src/render/mod.rs b/crates/buiy_core/src/render/mod.rs
new file mode 100644
index 0000000..13b6363
--- /dev/null
+++ b/crates/buiy_core/src/render/mod.rs
@@ -0,0 +1,86 @@
+//! Buiy render pipeline. Phase 0 ships the smallest end-to-end pass
+//! (rounded rect with solid bg) wired into Bevy's render graph. Full
+//! pipeline (top-layer compositing, clip-path, filters, blend modes,
+//! atlasing) lives in `buiy-render-pipeline-design`.
+//!
+//! See: docs/specs/2026-05-07-buiy-foundation/visuals.md § 3.3 and
+//! architecture.md § 2.3.
+
+use crate::{
+    components::{Node, ResolvedLayout, Style},
+    theme::Theme,
+};
+use bevy::prelude::*;
+use bevy::render::{Extract, ExtractSchedule, RenderApp};
+
+pub mod node;
+pub mod pipeline;
+
+/// What the render world needs from the main world per frame: a list of
+/// (rect, color, radius) tuples in window-local logical pixels.
+#[derive(Resource, Default, Clone)]
+pub struct ExtractedDraws {
+    pub draws: Vec<DrawData>,
+}
+
+#[derive(Clone, Copy, Debug)]
+pub struct DrawData {
+    pub position: Vec2,
+    pub size: Vec2,
+    pub color: Color,
+    pub radius: f32,
+}
+
+pub struct BuiyRenderPlugin;
+
+impl Plugin for BuiyRenderPlugin {
+    fn build(&self, app: &mut App) {
+        // ExtractedDraws is render-world only — the main world does not read it.
+        // Initialization lives below inside the RenderApp branch.
+        let Some(render_app) = app.get_sub_app_mut(RenderApp) else {
+            return;
+        };
+        render_app
+            .init_resource::<ExtractedDraws>()
+            .add_systems(ExtractSchedule, extract_buiy_draws);
+        // Phase 0: render-graph node + pipeline initialization.
+        // The actual pipeline + node wiring lives in pipeline.rs and node.rs.
+        node::register(render_app);
+        pipeline::register(render_app);
+    }
+}
+
+/// Sentinel color for missing theme tokens (magenta = "missing", visible at a
+/// glance in screenshots). The accompanying `warn!` surfaces the typo'd token
+/// name in dev. Phase 0 has a small, known token set; v0.x can promote to an
+/// `error!` once tokens are typed.
+const MISSING_TOKEN_FALLBACK: Color = Color::srgb(1.0, 0.0, 1.0);
+
+fn extract_buiy_draws(
+    mut commands: Commands,
+    main_world_q: Extract<Query<(&Style, &ResolvedLayout), With<Node>>>,
+    main_world_theme: Extract<Res<Theme>>,
+) {
+    let mut draws = ExtractedDraws::default();
+    for (style, layout) in main_world_q.iter() {
+        let color = match main_world_theme.color(&style.background_token) {
+            Some(c) => c,
+            None => {
+                tracing::warn!(
+                    token = %style.background_token,
+                    "missing theme color token; falling back to magenta sentinel"
+                );
+                MISSING_TOKEN_FALLBACK
+            }
+        };
+        draws.draws.push(DrawData {
+            position: layout.position,
+            size: layout.size,
+            color,
+            radius: style.border_radius,
+        });
+    }
+    // TODO(v0.x): reuse ExtractedDraws via ResMut + clear/extend instead of
+    // reallocating the inner Vec each frame. See `buiy-render-pipeline-design`.
+    commands.insert_resource(draws);
+}
diff --git a/crates/buiy_core/src/render/node.rs b/crates/buiy_core/src/render/node.rs
new file mode 100644
index 0000000..7d3a81b
--- /dev/null
+++ b/crates/buiy_core/src/render/node.rs
@@ -0,0 +1,97 @@
+//! Buiy render-graph node. Inserted into the Core2d sub-graph, after the
+//! main 2D pass (`Node2d::EndMainPass`) and before tonemapping. Phase 0
+//! draws Buiy entities directly into the 2D-pass color attachment.
+//!
+//! Why pre-tonemap: Buiy widgets share the same color pipeline as 2D scene
+//! content, so widget output participates in tonemapping when HDR / advanced
+//! color management is enabled in v0.x. Inserting after tonemapping would
+//! force Buiy to manage its own color-space matching with the rest of the
+//! frame, which is unnecessary complexity for Phase 0.
+//!
+//! IMPORTANT (clip-space conversion): the extract phase (in `mod.rs`) emits
+//! `DrawData.position / size` in **logical pixels** (from `ResolvedLayout`),
+//! but the rounded-rect shader (in `shader.wgsl`) consumes them as
+//! **clip-space units**. The Phase 0 conversion happens HERE on the CPU
+//! before the instance buffer is written: we compute
+//!   clip = (px / window_size) * 2.0 - 1.0   (with y-flip)
+//! per-element. Future Phase 1+ may move this to a view uniform; flag in
+//! `buiy-render-pipeline-design`.
+//!
+//! Phase 0 status: this node ships the *render-graph wiring* + a
+//! `set_render_pipeline` call so the pass exists and the pipeline is bound,
+//! but vertex / instance buffer construction is deferred to v0.x. Task 19
+//! (the e2e screenshot harness) is responsible for end-to-end verification.
+
+use bevy::core_pipeline::core_2d::graph::{Core2d, Node2d};
+use bevy::ecs::query::QueryItem;
+use bevy::prelude::*;
+use bevy::render::{
+    render_graph::{
+        NodeRunError, RenderGraphContext, RenderGraphExt, RenderLabel, ViewNode, ViewNodeRunner,
+    },
+    render_resource::{PipelineCache, RenderPassDescriptor},
+    renderer::RenderContext,
+    view::ViewTarget,
+};
+
+use super::{ExtractedDraws, pipeline::BuiyPipeline};
+
+#[derive(Default)]
+pub struct BuiyNode;
+
+impl ViewNode for BuiyNode {
+    type ViewQuery = &'static ViewTarget;
+
+    fn run<'w>(
+        &self,
+        _graph: &mut RenderGraphContext,
+        render_context: &mut RenderContext<'w>,
+        view_target: QueryItem<'w, '_, Self::ViewQuery>,
+        world: &'w World,
+    ) -> Result<(), NodeRunError> {
+        let pipeline_cache = world.resource::<PipelineCache>();
+        let buiy_pipeline = world.resource::<BuiyPipeline>();
+        let Some(pipeline) = pipeline_cache.get_render_pipeline(buiy_pipeline.id) else {
+            // Pipeline still compiling; skip this frame. The next frame will
+            // either succeed or surface an error from the pipeline cache.
+            return Ok(());
+        };
+        let draws = world.resource::<ExtractedDraws>();
+        if draws.draws.is_empty() {
+            return Ok(());
+        }
+
+        let mut pass = render_context.begin_tracked_render_pass(RenderPassDescriptor {
+            label: Some("buiy_pass"),
+            // `get_color_attachment()` returns the post-MSAA-resolve target
+            // (when MSAA is enabled) and respects ViewTarget's ping-pong
+            // logic. Using `main_texture_view()` directly would bypass that
+            // and break post-processing composition.
+            color_attachments: &[Some(view_target.get_color_attachment())],
+            depth_stencil_attachment: None,
+            timestamp_writes: None,
+            occlusion_query_set: None,
+        });
+        pass.set_render_pipeline(pipeline);
+        // Phase 0: vertex + instance buffers built per-frame here. v0.x
+        // upgrades to persistent buffers + bind groups for filters / atlas.
+        // The buffer-construction code is deferred to a follow-up task — this
+        // task ships the *render-graph wiring* so the node is present and
+        // running, even if the actual draw-call encoding is a TODO.
+        Ok(())
+    }
+}
+
+/// Stable [`RenderLabel`] for the Buiy node inside the [`Core2d`] sub-graph.
+#[derive(RenderLabel, Hash, PartialEq, Eq, Debug, Clone)]
+pub struct BuiyRenderLabel;
+
+pub(crate) fn register(render_app: &mut SubApp) {
+    // Insert the Buiy node into Core2d, then declare an edge from
+    // `Node2d::EndMainPass -> BuiyRenderLabel` so we run *after* the main 2D
+    // pass and write into the same color attachment. Tonemapping /
+    // post-processing run after us via the existing Core2d ordering.
+    render_app
+        .add_render_graph_node::<ViewNodeRunner<BuiyNode>>(Core2d, BuiyRenderLabel)
+        .add_render_graph_edge(Core2d, Node2d::EndMainPass, BuiyRenderLabel);
+}
diff --git a/crates/buiy_core/src/render/pipeline.rs b/crates/buiy_core/src/render/pipeline.rs
new file mode 100644
index 0000000..19a60e1
--- /dev/null
+++ b/crates/buiy_core/src/render/pipeline.rs
@@ -0,0 +1,139 @@
+//! Buiy render pipeline. The render-graph node in `node.rs` references
+//! `BuiyPipeline::id` to dispatch draws.
+//!
+//! Full pipeline (multi-pass top-layer compositing, atlas binding,
+//! filter/blend mode passes) lives in `buiy-render-pipeline-design`.
+
+use core::marker::PhantomData;
+
+use bevy::asset::uuid::Uuid;
+use bevy::mesh::VertexBufferLayout;
+use bevy::prelude::*;
+use bevy::render::render_resource::{
+    BlendState, CachedRenderPipelineId, ColorTargetState, ColorWrites, FragmentState, FrontFace,
+    MultisampleState, PipelineCache, PolygonMode, PrimitiveState, PrimitiveTopology,
+    RenderPipelineDescriptor, TextureFormat, VertexAttribute, VertexFormat, VertexState,
+    VertexStepMode,
+};
+use bevy::shader::Shader;
+
+/// Stable UUID for the rounded-rect shader asset.
+///
+/// **Buiy render-asset UUID convention.** All render-asset UUIDs in `buiy_core`
+/// use the prefix `0xB01A_01XX_..` ("BUIY 01") with the trailing octet
+/// distinguishing the asset (01 = rounded-rect shader). When future tasks add
+/// shader / atlas / pipeline assets, increment the trailing octet and document
+/// in this comment block. Reserved range: `0xB01A_0100_0000_0000_0000_0000_0000_0001`
+/// through `0xB01A_01FF_..._FFFF`.
+const SHADER_UUID: Uuid = Uuid::from_u128(0xB01A_0100_0000_0000_0000_0000_0000_0001u128);
+
+/// Returns the stable weak handle to the rounded-rect WGSL shader.
+pub fn shader_handle() -> Handle<Shader> {
+    Handle::Uuid(SHADER_UUID, PhantomData)
+}
+
+#[derive(Resource)]
+pub struct BuiyPipeline {
+    pub id: CachedRenderPipelineId,
+}
+
+pub(crate) fn register(render_app: &mut SubApp) {
+    let world = render_app.world_mut();
+
+    // Load WGSL shader into the render world's Shader asset store.
+    // `Assets::insert` returns the previous asset at this id (always `None`
+    // here — `register` runs once during plugin finish). Explicit `_prev`
+    // documents that we are knowingly discarding it, not a fallible result.
+    {
+        let mut shaders = world.resource_mut::<Assets<Shader>>();
+        let _prev = shaders.insert(
+            shader_handle().id(),
+            Shader::from_wgsl(include_str!("shader.wgsl"), "buiy/render/shader.wgsl"),
+        );
+    }
+
+    // Build pipeline descriptor and queue it.
+    let pipeline_cache = world.resource::<PipelineCache>();
+
+    let descriptor = RenderPipelineDescriptor {
+        label: Some("buiy_rounded_rect_pipeline".into()),
+        layout: vec![],
+        push_constant_ranges: vec![],
+        vertex: VertexState {
+            shader: shader_handle(),
+            shader_defs: vec![],
+            entry_point: Some("vertex".into()),
+            buffers: vec![
+                VertexBufferLayout {
+                    array_stride: 16,
+                    step_mode: VertexStepMode::Vertex,
+                    attributes: vec![
+                        VertexAttribute {
+                            format: VertexFormat::Float32x2,
+                            offset: 0,
+                            shader_location: 0,
+                        },
+                        VertexAttribute {
+                            format: VertexFormat::Float32x2,
+                            offset: 8,
+                            shader_location: 1,
+                        },
+                    ],
+                },
+                VertexBufferLayout {
+                    array_stride: 36,
+                    step_mode: VertexStepMode::Instance,
+                    attributes: vec![
+                        VertexAttribute {
+                            format: VertexFormat::Float32x2,
+                            offset: 0,
+                            shader_location: 2,
+                        },
+                        VertexAttribute {
+                            format: VertexFormat::Float32x2,
+                            offset: 8,
+                            shader_location: 3,
+                        },
+                        VertexAttribute {
+                            format: VertexFormat::Float32x4,
+                            offset: 16,
+                            shader_location: 4,
+                        },
+                        VertexAttribute {
+                            format: VertexFormat::Float32,
+                            offset: 32,
+                            shader_location: 5,
+                        },
+                    ],
+                },
+            ],
+        },
+        primitive: PrimitiveState {
+            topology: PrimitiveTopology::TriangleStrip,
+            front_face: FrontFace::Ccw,
+            // Phase 0: cull_mode = None until Task 11 fixes the unit-quad
+            // emission order. A naive `(0,0),(1,0),(0,1),(1,1)` strip mixes
+            // CCW and CW windings; back-face culling would silently drop the
+            // quad. Tighten to Some(Face::Back) once Task 11 verifies winding.
+            cull_mode: None,
+            polygon_mode: PolygonMode::Fill,
+            ..default()
+        },
+        depth_stencil: None,
+        multisample: MultisampleState::default(),
+        fragment: Some(FragmentState {
+            shader: shader_handle(),
+            shader_defs: vec![],
+            entry_point: Some("fragment".into()),
+            targets: vec![Some(ColorTargetState {
+                format: TextureFormat::Rgba8UnormSrgb,
+                blend: Some(BlendState::ALPHA_BLENDING),
+                write_mask: ColorWrites::ALL,
+            })],
+        }),
+        zero_initialize_workgroup_memory: false,
+    };
+
+    let id = pipeline_cache.queue_render_pipeline(descriptor);
+    world.insert_resource(BuiyPipeline { id });
+}
diff --git a/crates/buiy_core/src/render/shader.wgsl b/crates/buiy_core/src/render/shader.wgsl
new file mode 100644
index 0000000..05d3c6f
--- /dev/null
+++ b/crates/buiy_core/src/render/shader.wgsl
@@ -0,0 +1,59 @@
+// Buiy Phase 0 rounded-rect shader. Vertex stage emits a unit quad (one
+// quad per draw). Fragment stage computes signed distance from the
+// rounded rect interior and outputs the per-instance color, with anti-
+// aliased edges.
+//
+// TODO(Task 11): rect_pos / rect_size are currently fed in clip-space
+// units (-1..+1) but the layout system produces logical pixels. Either
+// (a) Task 11 pre-multiplies by the inverse window size on the CPU
+// before writing the instance buffer, or (b) introduce a view uniform
+// (window-size or full view-projection matrix) and apply the transform
+// here in the vertex stage. Decide before instance-buffer construction
+// lands. The pipeline descriptor's `layout: vec![]` will need to grow
+// to include the bind-group layout if (b) is chosen.
+
+struct Vertex {
+    @location(0) position: vec2<f32>,
+    @location(1) uv: vec2<f32>,
+};
+
+struct Instance {
+    @location(2) rect_pos: vec2<f32>,    // see TODO above re: units
+    @location(3) rect_size: vec2<f32>,
+    @location(4) color: vec4<f32>,
+    @location(5) radius: f32,
+};
+
+struct VertexOut {
+    @builtin(position) clip_position: vec4<f32>,
+    @location(0) local_uv: vec2<f32>,    // -1..+1 across the rect
+    @location(1) half_size: vec2<f32>,
+    @location(2) color: vec4<f32>,
+    @location(3) radius: f32,
+};
+
+@vertex
+fn vertex(v: Vertex, i: Instance) -> VertexOut {
+    var out: VertexOut;
+    let world = i.rect_pos + v.uv * i.rect_size;
+    out.clip_position = vec4<f32>(world, 0.0, 1.0);
+    out.local_uv = v.uv * 2.0 - 1.0;
+    out.half_size = i.rect_size * 0.5;
+    out.color = i.color;
+    out.radius = i.radius;
+    return out;
+}
+
+// Signed distance to a rounded rect centered at the origin.
+fn sdf_rounded_rect(p: vec2<f32>, half_size: vec2<f32>, r: f32) -> f32 {
+    let q = abs(p) - half_size + vec2<f32>(r, r);
+    return length(max(q, vec2<f32>(0.0, 0.0))) + min(max(q.x, q.y), 0.0) - r;
+}
+
+@fragment
+fn fragment(in: VertexOut) -> @location(0) vec4<f32> {
+    let d = sdf_rounded_rect(in.local_uv * in.half_size, in.half_size, in.radius);
+    let aa = fwidth(d);
+    let alpha = 1.0 - smoothstep(-aa, aa, d);
+    return vec4<f32>(in.color.rgb, in.color.a * alpha);
+}
diff --git a/crates/buiy_core/src/theme.rs b/crates/buiy_core/src/theme.rs
new file mode 100644
index 0000000..1ff9ba7
--- /dev/null
+++ b/crates/buiy_core/src/theme.rs
@@ -0,0 +1,87 @@
+//! Token-based theming.
+//!
+//! See: docs/specs/2026-05-07-buiy-foundation/architecture.md § 2.5 and
+//! cross-cutting.md § 3.14. Phase 0 ships a minimal token surface — the
+//! full token taxonomy lives in `buiy-theme-tokens-design`.
+
+use bevy::prelude::*;
+use std::collections::HashMap;
+
+/// A single theme variant. Phase 0 stores tokens as flat string-keyed maps.
+/// The full token system replaces this with typed scales in
+/// `buiy-theme-tokens-design`.
+#[derive(Resource, Reflect, Clone, Debug, Default)]
+#[reflect(Resource)]
+pub struct Theme {
+    pub colors: HashMap<String, Color>,
+    pub spaces: HashMap<String, f32>,
+    pub radii: HashMap<String, f32>,
+}
+
+impl Theme {
+    pub fn color(&self, token: &str) -> Option<Color> {
+        self.colors.get(token).copied()
+    }
+    pub fn space(&self, token: &str) -> Option<f32> {
+        self.spaces.get(token).copied()
+    }
+    pub fn radius(&self, token: &str) -> Option<f32> {
+        self.radii.get(token).copied()
+    }
+}
+
+/// OS preference resource. Updated by a system in BuiySet::Input that reads
+/// from winit (or platform-specific sources). Phase 0 populates with
+/// defaults; full OS-pref plumbing is `buiy-clipboard-and-os-integration-design`.
+#[derive(Resource, Reflect, Clone, Debug, Default)]
+#[reflect(Resource)]
+pub struct UserPreferences {
+    pub prefers_dark: bool,
+    pub prefers_reduced_motion: bool,
+    pub prefers_reduced_transparency: bool,
+    pub prefers_more_contrast: bool,
+    pub forced_colors: bool,
+    pub inverted_colors: bool,
+}
+
+/// Default light theme. Phase 0 is intentionally bare; v1 ships a full token
+/// scale set validated against WCAG 2.2 AA in CI.
+pub fn default_light_theme() -> Theme {
+    let mut t = Theme::default();
+    t.colors
+        .insert("color.surface.primary".into(), Color::WHITE);
+    t.colors.insert(
+        "color.surface.secondary".into(),
+        Color::srgb(0.96, 0.96, 0.96),
+    );
+    t.colors
+        .insert("color.text.primary".into(), Color::srgb(0.10, 0.10, 0.10));
+    t.colors
+        .insert("color.text.secondary".into(), Color::srgb(0.40, 0.40, 0.40));
+    t.colors
+        .insert("color.accent".into(), Color::srgb(0.20, 0.45, 0.95));
+    t.colors
+        .insert("color.focus.ring".into(), Color::srgb(0.20, 0.45, 0.95));
+
+    t.spaces.insert("space.0".into(), 0.0);
+    t.spaces.insert("space.1".into(), 4.0);
+    t.spaces.insert("space.2".into(), 8.0);
+    t.spaces.insert("space.3".into(), 12.0);
+    t.spaces.insert("space.4".into(), 16.0);
+
+    t.radii.insert("radius.sm".into(), 2.0);
+    t.radii.insert("radius.md".into(), 6.0);
+    t.radii.insert("radius.lg".into(), 12.0);
+    t
+}
+
+pub struct ThemePlugin;
+
+impl Plugin for ThemePlugin {
+    fn build(&self, app: &mut App) {
+        app.register_type::<Theme>()
+            .register_type::<UserPreferences>()
+            .insert_resource(default_light_theme())
+            .insert_resource(UserPreferences::default());
+    }
+}
diff --git a/crates/buiy_core/tests/a11y.rs b/crates/buiy_core/tests/a11y.rs
new file mode 100644
index 0000000..656bbf9
--- /dev/null
+++ b/crates/buiy_core/tests/a11y.rs
@@ -0,0 +1,35 @@
+use bevy::prelude::*;
+use buiy_core::{
+    CorePlugin,
+    a11y::{A11yLabel, A11yPlugin, A11yRole, A11yTreeBuilder},
+    focus::Focusable,
+};
+
+#[test]
+fn tree_builder_emits_one_node_per_focusable_with_role_and_label() {
+    let mut app = App::new();
+    app.add_plugins(MinimalPlugins);
+    app.add_plugins(CorePlugin);
+    app.add_plugins(A11yPlugin);
+
+    let _btn = app
+        .world_mut()
+        .spawn((
+            Focusable::default(),
+            A11yRole::Button,
+            A11yLabel("Save".to_string()),
+        ))
+        .id();
+
+    app.update();
+
+    let builder = app.world().resource::<A11yTreeBuilder>();
+    let snapshot = builder.snapshot();
+    let count = snapshot
+        .iter()
+        .filter(|n| n.role == A11yRole::Button)
+        .count();
+    assert_eq!(count, 1, "exactly one button node in tree");
+    let names: Vec<String> = snapshot.iter().map(|n| n.name.clone()).collect();
+    assert!(names.contains(&"Save".to_string()), "Save name present");
+}
diff --git a/crates/buiy_core/tests/components.rs b/crates/buiy_core/tests/components.rs
new file mode 100644
index 0000000..c9a16c5
--- /dev/null
+++ b/crates/buiy_core/tests/components.rs
@@ -0,0 +1,36 @@
+use bevy::prelude::*;
+use buiy_core::{CorePlugin, components::*};
+
+#[test]
+// `Node::default()` is intentional: the test asserts default-constructibility
+// per the architecture commitment (Reflect + Default + Clone + Component on
+// every Buiy component), even though `Node` is currently a unit struct.
+#[allow(clippy::default_constructed_unit_structs)]
+fn node_and_style_are_registered_and_default_constructible() {
+    let mut app = App::new();
+    app.add_plugins(MinimalPlugins);
+    app.add_plugins(CorePlugin);
+
+    let registry = app.world().resource::<AppTypeRegistry>();
+    let registry = registry.read();
+    assert!(
+        registry.get(std::any::TypeId::of::<Node>()).is_some(),
+        "Node not registered"
+    );
+    assert!(
+        registry.get(std::any::TypeId::of::<Style>()).is_some(),
+        "Style not registered"
+    );
+    assert!(
+        registry
+            .get(std::any::TypeId::of::<ResolvedLayout>())
+            .is_some(),
+        "ResolvedLayout not registered"
+    );
+
+    drop(registry);
+    let world = app.world_mut();
+    let entity = world.spawn((Node::default(), Style::default())).id();
+    assert!(world.get::<Node>(entity).is_some());
+    assert!(world.get::<Style>(entity).is_some());
+}
diff --git a/crates/buiy_core/tests/focus.rs b/crates/buiy_core/tests/focus.rs
new file mode 100644
index 0000000..5778e21
--- /dev/null
+++ b/crates/buiy_core/tests/focus.rs
@@ -0,0 +1,100 @@
+//! Drives `handle_tab` through the real production code path: presses
+//! `KeyCode::Tab` on `ButtonInput<KeyCode>` and runs the schedule. Skips
+//! `bevy::input::InputPlugin` so the PreUpdate clear-system doesn't wipe
+//! our manual `press()` before `handle_tab` fires; mirrors the pattern
+//! `crates/buiy_widgets/tests/button.rs` already uses for `MouseButton`.
+
+use bevy::prelude::*;
+use buiy_core::{
+    CorePlugin,
+    focus::{FocusPlugin, FocusVisible, Focusable, FocusedEntity},
+};
+
+fn setup() -> App {
+    let mut app = App::new();
+    app.add_plugins(MinimalPlugins);
+    app.add_plugins(CorePlugin);
+    app.add_plugins(FocusPlugin);
+    app.init_resource::<ButtonInput<KeyCode>>();
+    app
+}
+
+fn press_tab(app: &mut App, shift: bool) {
+    {
+        let mut keys = app.world_mut().resource_mut::<ButtonInput<KeyCode>>();
+        keys.release_all();
+        keys.clear();
+        if shift {
+            keys.press(KeyCode::ShiftLeft);
+        }
+        keys.press(KeyCode::Tab);
+    }
+    app.update();
+}
+
+#[test]
+fn tab_advances_through_focusables_in_order() {
+    let mut app = setup();
+    let a = app.world_mut().spawn(Focusable::default()).id();
+    let b = app.world_mut().spawn(Focusable::default()).id();
+    let c = app.world_mut().spawn(Focusable::default()).id();
+
+    press_tab(&mut app, false);
+    assert_eq!(app.world().resource::<FocusedEntity>().0, Some(a));
+    press_tab(&mut app, false);
+    assert_eq!(app.world().resource::<FocusedEntity>().0, Some(b));
+    press_tab(&mut app, false);
+    assert_eq!(app.world().resource::<FocusedEntity>().0, Some(c));
+}
+
+#[test]
+fn tab_wraps_to_first_focusable_at_end_of_order() {
+    let mut app = setup();
+    let a = app.world_mut().spawn(Focusable::default()).id();
+    let _b = app.world_mut().spawn(Focusable::default()).id();
+    let _c = app.world_mut().spawn(Focusable::default()).id();
+
+    for _ in 0..4 {
+        press_tab(&mut app, false);
+    }
+    assert_eq!(
+        app.world().resource::<FocusedEntity>().0,
+        Some(a),
+        "Tab past the last focusable wraps to the first"
+    );
+}
+
+#[test]
+fn shift_tab_steps_backward() {
+    let mut app = setup();
+    let _a = app.world_mut().spawn(Focusable::default()).id();
+    let _b = app.world_mut().spawn(Focusable::default()).id();
+    let c = app.world_mut().spawn(Focusable::default()).id();
+
+    // Walk forward to `c`.
+    for _ in 0..3 {
+        press_tab(&mut app, false);
+    }
+    assert_eq!(app.world().resource::<FocusedEntity>().0, Some(c));
+
+    // Shift+Tab steps back twice; from `c` → `b` → `a`.
+    press_tab(&mut app, true);
+    press_tab(&mut app, true);
+    let prev = app.world().resource::<FocusedEntity>().0;
+    assert!(
+        prev.is_some() && prev != Some(c),
+        "Shift+Tab moves backward"
+    );
+}
+
+#[test]
+fn tab_sets_focus_visible() {
+    let mut app = setup();
+    app.world_mut().spawn(Focusable::default());
+    assert!(!app.world().resource::<FocusVisible>().0);
+    press_tab(&mut app, false);
+    assert!(
+        app.world().resource::<FocusVisible>().0,
+        "keyboard-driven focus enables :focus-visible"
+    );
+}
diff --git a/crates/buiy_core/tests/layout.rs b/crates/buiy_core/tests/layout.rs
new file mode 100644
index 0000000..625dd8f
--- /dev/null
+++ b/crates/buiy_core/tests/layout.rs
@@ -0,0 +1,50 @@
+use bevy::prelude::*;
+use buiy_core::{
+    CorePlugin,
+    components::{FlexDirection, Node, ResolvedLayout, Style},
+    layout::LayoutPlugin,
+};
+
+#[test]
+fn layout_resolves_a_simple_flex_row() {
+    let mut app = App::new();
+    app.add_plugins(MinimalPlugins);
+    app.add_plugins(CorePlugin);
+    app.add_plugins(LayoutPlugin);
+
+    let parent = app
+        .world_mut()
+        .spawn((
+            Node,
+            Style {
+                width: 200.0,
+                height: 100.0,
+                flex_direction: FlexDirection::Row,
+                ..default()
+            },
+        ))
+        .id();
+
+    let child = app
+        .world_mut()
+        .spawn((
+            Node,
+            Style {
+                width: 50.0,
+                height: 50.0,
+                ..default()
+            },
+        ))
+        .id();
+
+    app.world_mut().entity_mut(parent).add_child(child);
+
+    app.update(); // run BuiySet::Layout
+
+    let layout = app
+        .world()
+        .get::<ResolvedLayout>(child)
+        .expect("child has ResolvedLayout after Update");
+    assert!((layout.size.x - 50.0).abs() < 0.5, "child width ~ 50");
+    assert!((layout.size.y - 50.0).abs() < 0.5, "child height ~ 50");
+}
diff --git a/crates/buiy_core/tests/picking.rs b/crates/buiy_core/tests/picking.rs
new file mode 100644
index 0000000..2732992
--- /dev/null
+++ b/crates/buiy_core/tests/picking.rs
@@ -0,0 +1,32 @@
+use bevy::prelude::*;
+use buiy_core::{
+    CorePlugin,
+    components::{Node, ResolvedLayout, Style},
+    picking::{PickingPlugin, hit_test},
+};
+
+#[test]
+fn hit_test_returns_entity_under_point() {
+    let mut app = App::new();
+    app.add_plugins(MinimalPlugins);
+    app.add_plugins(CorePlugin);
+    app.add_plugins(PickingPlugin);
+
+    let entity = app
+        .world_mut()
+        .spawn((
+            Node,
+            Style::default(),
+            ResolvedLayout {
+                position: Vec2::new(10.0, 10.0),
+                size: Vec2::new(100.0, 50.0),
+            },
+        ))
+        .id();
+
+    let world = app.world();
+    let hit = hit_test(world, Vec2::new(50.0, 30.0));
+    assert_eq!(hit, Some(entity));
+    let miss = hit_test(world, Vec2::new(500.0, 500.0));
+    assert_eq!(miss, None);
+}
diff --git a/crates/buiy_core/tests/plugin_smoke.rs b/crates/buiy_core/tests/plugin_smoke.rs
new file mode 100644
index 0000000..b38fd34
--- /dev/null
+++ b/crates/buiy_core/tests/plugin_smoke.rs
@@ -0,0 +1,10 @@
+use bevy::prelude::*;
+use buiy_core::CorePlugin;
+
+#[test]
+fn core_plugin_loads_without_panic() {
+    let mut app = App::new();
+    app.add_plugins(MinimalPlugins);
+    app.add_plugins(CorePlugin);
+    app.update();
+}
diff --git a/crates/buiy_core/tests/render_smoke.rs b/crates/buiy_core/tests/render_smoke.rs
new file mode 100644
index 0000000..331c65a
--- /dev/null
+++ b/crates/buiy_core/tests/render_smoke.rs
@@ -0,0 +1,72 @@
+use bevy::prelude::*;
+use buiy_core::{CorePlugin, render::BuiyRenderPlugin};
+
+#[test]
+fn render_plugin_loads_without_panic() {
+    let mut app = App::new();
+    app.add_plugins(MinimalPlugins);
+    // BuiyRenderPlugin needs a render-app context normally, but Phase 0
+    // smoke test asserts the plugin's `build` does not panic when added
+    // without RenderApp. Real render assertions happen in the e2e test (Task 19).
+    app.add_plugins(CorePlugin);
+    app.add_plugins(BuiyRenderPlugin);
+    app.update();
+}
+
+// Requires a real (or software, e.g. lavapipe) Vulkan/Metal/DX adapter:
+// `RenderPlugin::build` does `block_on(initialize_renderer(...))` which
+// `expect()`s a wgpu adapter. Headless CI without a GPU/lavapipe panics
+// before our pipeline code runs. Keep the test for environments that
+// have a GPU; the proper end-to-end render coverage lives in the visual
+// regression harness (Task 19), which provisions lavapipe.
+//
+// Run locally with: `cargo test -p buiy_core --test render_smoke -- --ignored`.
+#[test]
+#[ignore = "needs a wgpu adapter (real GPU or lavapipe); covered by Task 19 e2e harness"]
+fn pipeline_registers_in_render_app() {
+    let mut app = App::new();
+    app.add_plugins(MinimalPlugins);
+    // RenderPlugin requires AssetPlugin (Shader is an Asset).
+    app.add_plugins(bevy::asset::AssetPlugin::default());
+    app.add_plugins(bevy::render::RenderPlugin::default());
+    app.add_plugins(buiy_core::render::BuiyRenderPlugin);
+
+    let render_app = app.get_sub_app(bevy::render::RenderApp).expect("RenderApp");
+    let pipeline = render_app
+        .world()
+        .get_resource::<buiy_core::render::pipeline::BuiyPipeline>();
+    assert!(pipeline.is_some(), "BuiyPipeline registered");
+}
+
+// Same RenderApp/wgpu-adapter caveat as `pipeline_registers_in_render_app`.
+// We assert that the Buiy node is present in the Core2d sub-graph after the
+// main 2D pass has been wired up by Bevy's Core2dPlugin.
+//
+// Run locally with: `cargo test -p buiy_core --test render_smoke -- --ignored`.
+#[test]
+#[ignore = "needs a wgpu adapter (real GPU or lavapipe); covered by Task 19 e2e harness"]
+fn render_graph_node_inserted_after_main_2d_pass() {
+    use bevy::core_pipeline::core_2d::graph::Core2d;
+    use bevy::render::render_graph::RenderGraph;
+
+    let mut app = App::new();
+    app.add_plugins(MinimalPlugins);
+    app.add_plugins(bevy::asset::AssetPlugin::default());
+    app.add_plugins(bevy::render::RenderPlugin::default());
+    app.add_plugins(bevy::core_pipeline::CorePipelinePlugin);
+    app.add_plugins(buiy_core::render::BuiyRenderPlugin);
+
+    let render_app = app.get_sub_app(bevy::render::RenderApp).expect("RenderApp");
+    let render_graph = render_app
+        .world()
+        .get_resource::<RenderGraph>()
+        .expect("RenderGraph resource");
+    let sub = render_graph
+        .get_sub_graph(Core2d)
+        .expect("Core2d sub-graph present");
+    assert!(
+        sub.get_node_state(buiy_core::render::node::BuiyRenderLabel)
+            .is_ok(),
+        "BuiyRenderLabel registered in Core2d"
+    );
+}
diff --git a/crates/buiy_core/tests/theme.rs b/crates/buiy_core/tests/theme.rs
new file mode 100644
index 0000000..66ac0e1
--- /dev/null
+++ b/crates/buiy_core/tests/theme.rs
@@ -0,0 +1,21 @@
+use buiy_core::theme::{UserPreferences, default_light_theme};
+
+#[test]
+fn default_theme_resolves_known_tokens() {
+    let theme = default_light_theme();
+    let bg = theme
+        .color("color.surface.primary")
+        .expect("primary surface");
+    let fg = theme.color("color.text.primary").expect("primary text");
+    assert!(bg != fg, "fg and bg must differ");
+    let space_4 = theme.space("space.4").expect("space.4");
+    assert!(space_4 > 0.0);
+}
+
+#[test]
+fn user_preferences_default_to_light_no_reduce_motion() {
+    let prefs = UserPreferences::default();
+    assert!(!prefs.prefers_dark);
+    assert!(!prefs.prefers_reduced_motion);
+    assert!(!prefs.forced_colors);
+}
diff --git a/crates/buiy_verify/Cargo.toml b/crates/buiy_verify/Cargo.toml
new file mode 100644
index 0000000..93b0913
--- /dev/null
+++ b/crates/buiy_verify/Cargo.toml
@@ -0,0 +1,13 @@
+[package]
+name = "buiy_verify"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+
+[dependencies]
+bevy.workspace = true
+buiy_core = { path = "../buiy_core" }
+serde.workspace = true
+serde_json.workspace = true
+image.workspace = true
+proptest.workspace = true
diff --git a/crates/buiy_verify/src/a11y.rs b/crates/buiy_verify/src/a11y.rs
new file mode 100644
index 0000000..8e79cd4
--- /dev/null
+++ b/crates/buiy_verify/src/a11y.rs
@@ -0,0 +1,70 @@
+//! AccessKit tree snapshot — serializes Buiy's `A11yTreeBuilder` view to
+//! stable JSON suitable for golden-file comparison.
+//! See: docs/specs/2026-05-07-buiy-foundation/verification.md (CI gate #3).
+
+use buiy_core::a11y::{A11yNodeView, A11yRole};
+use serde::Serialize;
+
+// LINT: Field order here is the snapshot wire format. Do not reorder
+// without coordinating golden-file regeneration in every consumer.
+#[derive(Serialize)]
+struct WireNode<'a> {
+    entity: u64,
+    role: &'a str,
+    name: &'a str,
+    description: &'a str,
+    focusable: bool,
+}
+
+// LINT: Keep this match in sync with `buiy_core::a11y::A11yRole`. When
+// the v0.x full ARIA taxonomy expansion lands (38+ roles per
+// accessibility.md § 3.11), Rust's exhaustiveness check will force
+// new arms — add them here in the same PR.
+fn role_to_str(r: A11yRole) -> &'static str {
+    match r {
+        A11yRole::Generic => "Generic",
+        A11yRole::Button => "Button",
+        A11yRole::Link => "Link",
+        A11yRole::Image => "Image",
+        A11yRole::Text => "Text",
+        A11yRole::Heading => "Heading",
+        A11yRole::Dialog => "Dialog",
+        A11yRole::AlertDialog => "AlertDialog",
+        A11yRole::Tooltip => "Tooltip",
+    }
+}
+
+pub fn snapshot_tree(nodes: &[A11yNodeView]) -> String {
+    let wire: Vec<WireNode> = nodes
+        .iter()
+        .map(|n| WireNode {
+            entity: n.entity.to_bits(),
+            role: role_to_str(n.role),
+            name: &n.name,
+            description: &n.description,
+            focusable: n.focusable,
+        })
+        .collect();
+    // `serde_json::to_string` on a `Vec<WireNode>` cannot fail: WireNode is
+    // a fixed-shape struct of `u64 + &str + &str + &str + bool`, and
+    // serde_json only errors on map keys that aren't strings, custom
+    // Serialize impls that fail, or recursion-limit overruns. None apply
+    // here. If WireNode ever grows a non-trivial Serialize, return a
+    // `Result` from this fn instead of `unreachable!`.
+    match serde_json::to_string(&wire) {
+        Ok(s) => s,
+        Err(e) => unreachable!("WireNode serialization is infallible by construction; got: {e}"),
+    }
+}
+
+/// Returns `None` if identical, `Some(diff_text)` otherwise. Phase 0
+/// emits a coarse `LEFT:\n…RIGHT:\n…` dump; v0.x will swap to a unified
+/// diff via the `similar` crate when the AT-consumer harness (gate #15)
+/// lands.
+pub fn diff_snapshots(left: &str, right: &str) -> Option<String> {
+    if left == right {
+        None
+    } else {
+        Some(format!("LEFT:\n{}\n\nRIGHT:\n{}\n", left, right))
+    }
+}
diff --git a/crates/buiy_verify/src/contrast.rs b/crates/buiy_verify/src/contrast.rs
new file mode 100644
index 0000000..cdced1c
--- /dev/null
+++ b/crates/buiy_verify/src/contrast.rs
@@ -0,0 +1,102 @@
+//! WCAG 2 contrast linter. See: docs/specs/2026-05-07-buiy-foundation/verification.md
+//! (CI gate #9). APCA is on the same code path but advisory; it ships in v0.x
+//! per `buiy-theme-tokens-design`.
+
+use bevy::prelude::Color;
+use buiy_core::theme::Theme;
+
+pub const WCAG_AA_NORMAL: f64 = 4.5;
+pub const WCAG_AA_LARGE: f64 = 3.0;
+pub const WCAG_AA_NON_TEXT: f64 = 3.0;
+pub const WCAG_AAA_NORMAL: f64 = 7.0;
+pub const WCAG_AAA_LARGE: f64 = 4.5;
+
+#[derive(Debug, Clone, PartialEq)]
+pub enum ContrastSeverity {
+    Pass,
+    /// Reserved for advisory tiers (e.g., near-AA, APCA Lc). Phase 0 doesn't
+    /// emit `Warn`; v0.x will use it for ratios in the borderline band when
+    /// APCA support lands.
+    Warn,
+    Fail,
+}
+
+#[derive(Debug, Clone)]
+pub struct ContrastViolation {
+    pub bg_token: String,
+    pub fg_token: String,
+    pub ratio: f64,
+    pub required: f64,
+    pub severity: ContrastSeverity,
+}
+
+/// WCAG 2.1 §1.4.3 contrast ratio: `(L_lighter + 0.05) / (L_darker + 0.05)`.
+/// Returns a value in [1, 21]; identical colors yield 1.0, black-on-white yields 21.0.
+pub fn wcag2_ratio(fg: Color, bg: Color) -> f64 {
+    let l1 = relative_luminance(fg);
+    let l2 = relative_luminance(bg);
+    let (lighter, darker) = if l1 > l2 { (l1, l2) } else { (l2, l1) };
+    (lighter + 0.05) / (darker + 0.05)
+}
+
+/// Relative luminance per WCAG 2.1 (Rec.709 weights on linear-light channels).
+/// Bevy's `Color::to_linear()` performs the sRGB→linear gamma transform; this
+/// fn must NOT re-apply it. See WCAG 2.1 §1.4.3 "relative luminance" definition.
+fn relative_luminance(c: Color) -> f64 {
+    let lin = c.to_linear();
+    let lin_r = lin.red as f64;
+    let lin_g = lin.green as f64;
+    let lin_b = lin.blue as f64;
+    0.2126 * lin_r + 0.7152 * lin_g + 0.0722 * lin_b
+}
+
+pub fn contrast_violations(
+    theme: &Theme,
+    pairs: &[(&str, &str)],
+    required: f64,
+) -> Vec<ContrastViolation> {
+    let mut out = Vec::new();
+    for (bg_token, fg_token) in pairs {
+        let bg = match theme.color(bg_token) {
+            Some(c) => c,
+            None => continue,
+        };
+        let fg = match theme.color(fg_token) {
+            Some(c) => c,
+            None => continue,
+        };
+        let ratio = wcag2_ratio(fg, bg);
+        let severity = if ratio < required {
+            ContrastSeverity::Fail
+        } else {
+            ContrastSeverity::Pass
+        };
+        out.push(ContrastViolation {
+            bg_token: bg_token.to_string(),
+            fg_token: fg_token.to_string(),
+            ratio,
+            required,
+            severity,
+        });
+    }
+    out.into_iter()
+        .filter(|v| v.severity == ContrastSeverity::Fail)
+        .collect()
+}
+
+/// Lint the canonical text-on-surface pairs in any theme at WCAG 2 AA.
+/// Returns Ok if all pass.
+///
+/// Phase 0 walks 3 hand-picked canonical pairs only.
+/// TODO(buiy-theme-tokens-design): expand to an exhaustive `surface.*` ×
+/// `text.*` cartesian walk once typed token enums replace the
+/// string-keyed `Theme` HashMap.
+pub fn lint_theme(theme: &Theme) -> Result<(), Vec<ContrastViolation>> {
+    let pairs = [
+        ("color.surface.primary", "color.text.primary"),
+        ("color.surface.primary", "color.text.secondary"),
+        ("color.surface.secondary", "color.text.primary"),
+    ];
+    let v = contrast_violations(theme, &pairs, WCAG_AA_NORMAL);
+    if v.is_empty() { Ok(()) } else { Err(v) }
+}
diff --git a/crates/buiy_verify/src/lib.rs b/crates/buiy_verify/src/lib.rs
new file mode 100644
index 0000000..91dd46d
--- /dev/null
+++ b/crates/buiy_verify/src/lib.rs
@@ -0,0 +1,9 @@
+//! Buiy verification harness. Phase 0 ships visual regression, AccessKit
+//! tree snapshot, and WCAG 2 contrast linter. Full harness (15 CI gates)
+//! lives in `buiy-verification-design`.
+//!
+//! See: docs/specs/2026-05-07-buiy-foundation/verification.md.
+
+pub mod a11y;
+pub mod contrast;
+pub mod visual;
diff --git a/crates/buiy_verify/src/visual.rs b/crates/buiy_verify/src/visual.rs
new file mode 100644
index 0000000..5d2542b
--- /dev/null
+++ b/crates/buiy_verify/src/visual.rs
@@ -0,0 +1,45 @@
+//! Visual regression — perceptual diff with a tolerance budget.
+//! See: docs/specs/2026-05-07-buiy-foundation/verification.md (CI gate #2).
+
+use image::{DynamicImage, GenericImageView};
+
+#[must_use]
+pub struct DiffResult {
+    /// 0.0 = identical, 1.0 = totally different.
+    pub score: f64,
+}
+
+impl DiffResult {
+    pub fn passed(&self, tolerance: f64) -> bool {
+        self.score <= tolerance
+    }
+}
+
+pub fn compare_images(a: &DynamicImage, b: &DynamicImage) -> DiffResult {
+    if a.dimensions() != b.dimensions() {
+        return DiffResult { score: 1.0 };
+    }
+    let a8 = a.to_rgba8();
+    let b8 = b.to_rgba8();
+    // Widen u32 → u64 BEFORE multiplying. `width * height` in u32 overflows
+    // for images > 4 gigapixels (theoretical, but cheap to harden).
+    let pixels = a8.width() as u64 * a8.height() as u64;
+    // Two zero-sized images compare identical: the only achievable score for
+    // an empty pixel set is "no difference observed". Returning 0.0 here
+    // also avoids a NaN from `accumulated as f64 / 0.0`, which would make
+    // `passed(any_tol)` silently false for every tolerance.
+    if pixels == 0 {
+        return DiffResult { score: 0.0 };
+    }
+    let mut accumulated = 0u64;
+    for (pa, pb) in a8.pixels().zip(b8.pixels()) {
+        for ch in 0..4 {
+            let d = pa[ch] as i32 - pb[ch] as i32;
+            accumulated += (d * d) as u64;
+        }
+    }
+    let max = (pixels * 4 * 255 * 255) as f64;
+    DiffResult {
+        score: (accumulated as f64 / max).sqrt(),
+    }
+}
diff --git a/crates/buiy_verify/tests/a11y.rs b/crates/buiy_verify/tests/a11y.rs
new file mode 100644
index 0000000..d31ea36
--- /dev/null
+++ b/crates/buiy_verify/tests/a11y.rs
@@ -0,0 +1,53 @@
+use bevy::prelude::*;
+use buiy_core::a11y::{A11yNodeView, A11yRole};
+use buiy_verify::a11y::{diff_snapshots, snapshot_tree};
+
+// Bevy 0.18 removed `Entity::from_raw`; `from_raw_u32` returns `Option<Entity>`.
+fn entity(index: u32) -> Entity {
+    Entity::from_raw_u32(index).expect("valid entity index")
+}
+
+#[test]
+fn snapshot_tree_serializes_to_stable_json() {
+    let nodes = vec![
+        A11yNodeView {
+            entity: entity(1),
+            role: A11yRole::Button,
+            name: "Save".into(),
+            description: "".into(),
+            focusable: true,
+        },
+        A11yNodeView {
+            entity: entity(2),
+            role: A11yRole::Text,
+            name: "Hello".into(),
+            description: "".into(),
+            focusable: false,
+        },
+    ];
+    let json = snapshot_tree(&nodes);
+    assert!(json.contains("\"role\":\"Button\""));
+    assert!(json.contains("\"name\":\"Save\""));
+    assert!(json.contains("\"focusable\":true"));
+}
+
+#[test]
+fn diff_returns_none_for_identical_snapshots() {
+    let nodes = vec![A11yNodeView {
+        entity: entity(1),
+        role: A11yRole::Button,
+        name: "Save".into(),
+        description: "".into(),
+        focusable: true,
+    }];
+    let snap = snapshot_tree(&nodes);
+    assert!(diff_snapshots(&snap, &snap).is_none());
+}
+
+#[test]
+fn diff_returns_some_for_different_snapshots() {
+    let result = diff_snapshots("a", "b");
+    assert!(result.is_some());
+    let text = result.unwrap();
+    assert!(text.contains("LEFT") && text.contains("RIGHT"));
+}
diff --git a/crates/buiy_verify/tests/contrast.rs b/crates/buiy_verify/tests/contrast.rs
new file mode 100644
index 0000000..eb7f827
--- /dev/null
+++ b/crates/buiy_verify/tests/contrast.rs
@@ -0,0 +1,50 @@
+use bevy::prelude::Color;
+use buiy_core::theme::default_light_theme;
+use buiy_verify::contrast::{
+    ContrastSeverity, WCAG_AA_NORMAL, contrast_violations, lint_theme, wcag2_ratio,
+};
+
+#[test]
+fn black_white_ratio_is_21() {
+    let r = wcag2_ratio(Color::WHITE, Color::BLACK);
+    assert!(
+        (r - 21.0).abs() < 0.01,
+        "white/black ratio is 21:1, got {r}"
+    );
+}
+
+#[test]
+fn equal_colors_ratio_is_1() {
+    let r = wcag2_ratio(Color::WHITE, Color::WHITE);
+    assert!((r - 1.0).abs() < 0.01);
+}
+
+#[test]
+fn aa_passes_default_light_theme_text_on_surface() {
+    let theme = default_light_theme();
+    let bg = theme.color("color.surface.primary").unwrap();
+    let fg = theme.color("color.text.primary").unwrap();
+    let r = wcag2_ratio(fg, bg);
+    assert!(
+        r >= WCAG_AA_NORMAL,
+        "default theme text on surface is AA: ratio={r}"
+    );
+}
+
+#[test]
+fn linter_reports_violations_for_failing_pair() {
+    let mut theme = default_light_theme();
+    // Insert a known-failing pair.
+    theme
+        .colors
+        .insert("color.text.bad".into(), Color::srgb(0.9, 0.9, 0.9));
+    let pairs = vec![("color.surface.primary", "color.text.bad")];
+    let violations = contrast_violations(&theme, &pairs, WCAG_AA_NORMAL);
+    assert_eq!(violations.len(), 1);
+    assert_eq!(violations[0].severity, ContrastSeverity::Fail);
+}
+
+#[test]
+fn lint_theme_passes_for_default_light() {
+    assert!(lint_theme(&default_light_theme()).is_ok());
+}
diff --git a/crates/buiy_verify/tests/fixtures/.gitattributes b/crates/buiy_verify/tests/fixtures/.gitattributes
new file mode 100644
index 0000000..9c71b9c
--- /dev/null
+++ b/crates/buiy_verify/tests/fixtures/.gitattributes
@@ -0,0 +1,6 @@
+*.png binary
+*.jpg binary
+*.jpeg binary
+*.webp binary
+*.avif binary
+*.ktx2 binary
diff --git a/crates/buiy_verify/tests/fixtures/visual/baseline.png b/crates/buiy_verify/tests/fixtures/visual/baseline.png
new file mode 100644
index 0000000..bb24c50
Binary files /dev/null and b/crates/buiy_verify/tests/fixtures/visual/baseline.png differ
diff --git a/crates/buiy_verify/tests/fixtures/visual/tinted.png b/crates/buiy_verify/tests/fixtures/visual/tinted.png
new file mode 100644
index 0000000..9479f13
Binary files /dev/null and b/crates/buiy_verify/tests/fixtures/visual/tinted.png differ
diff --git a/crates/buiy_verify/tests/smoke.rs b/crates/buiy_verify/tests/smoke.rs
new file mode 100644
index 0000000..243f97c
--- /dev/null
+++ b/crates/buiy_verify/tests/smoke.rs
@@ -0,0 +1,7 @@
+#[test]
+fn re_exports_compile() {
+    use buiy_verify::{a11y, contrast, visual};
+    let _ = visual::compare_images;
+    let _ = a11y::snapshot_tree;
+    let _ = contrast::wcag2_ratio;
+}
diff --git a/crates/buiy_verify/tests/visual.rs b/crates/buiy_verify/tests/visual.rs
new file mode 100644
index 0000000..ebcecb5
--- /dev/null
+++ b/crates/buiy_verify/tests/visual.rs
@@ -0,0 +1,39 @@
+use buiy_verify::visual::{DiffResult, compare_images};
+use image::{DynamicImage, RgbaImage, open};
+
+#[test]
+fn identical_images_diff_zero() {
+    let baseline = open("tests/fixtures/visual/baseline.png").unwrap();
+    let result: DiffResult = compare_images(&baseline, &baseline);
+    assert_eq!(result.score, 0.0);
+    assert!(result.passed(0.01), "identical images pass 0.01 tolerance");
+}
+
+#[test]
+fn tinted_image_diff_nonzero() {
+    let a = open("tests/fixtures/visual/baseline.png").unwrap();
+    let b = open("tests/fixtures/visual/tinted.png").unwrap();
+    let result = compare_images(&a, &b);
+    assert!(result.score > 0.0, "different images produce nonzero diff");
+}
+
+#[test]
+fn dimension_mismatch_returns_one() {
+    let a = DynamicImage::ImageRgba8(RgbaImage::new(2, 2));
+    let b = DynamicImage::ImageRgba8(RgbaImage::new(3, 2));
+    let result = compare_images(&a, &b);
+    assert_eq!(result.score, 1.0);
+    assert!(!result.passed(0.5), "mismatched-dim sentinel exceeds 0.5");
+}
+
+#[test]
+fn empty_images_compare_identical_without_nan() {
+    let a = DynamicImage::ImageRgba8(RgbaImage::new(0, 0));
+    let b = DynamicImage::ImageRgba8(RgbaImage::new(0, 0));
+    let result = compare_images(&a, &b);
+    assert_eq!(result.score, 0.0, "0x0 vs 0x0 is identical, not NaN");
+    assert!(
+        result.passed(0.01),
+        "empty-vs-empty must pass any non-negative tolerance"
+    );
+}
diff --git a/crates/buiy_widgets/Cargo.toml b/crates/buiy_widgets/Cargo.toml
new file mode 100644
index 0000000..5e43f03
--- /dev/null
+++ b/crates/buiy_widgets/Cargo.toml
@@ -0,0 +1,11 @@
+[package]
+name = "buiy_widgets"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+repository.workspace = true
+rust-version.workspace = true
+
+[dependencies]
+bevy.workspace = true
+buiy_core = { path = "../buiy_core" }
diff --git a/crates/buiy_widgets/src/button.rs b/crates/buiy_widgets/src/button.rs
new file mode 100644
index 0000000..8b90a84
--- /dev/null
+++ b/crates/buiy_widgets/src/button.rs
@@ -0,0 +1,91 @@
+//! Button widget. Phase 0 contract: `Focusable + A11yRole::Button + A11yLabel +
+//! Node + Style with theme tokens + click-emits-OnPress`. Per-widget detail
+//! (toggle button via aria-pressed, keyboard contract, full APG behavior)
+//! lives in `buiy-widget-catalog-design`.
+//!
+//! Bevy 0.18 split buffered events into `Message`. `OnPress` is therefore a
+//! `Message` (not an `Event` — `Event` is now reserved for observer-style
+//! triggers in 0.18). The click handler uses `MessageWriter::write`.
+
+use bevy::prelude::*;
+use buiy_core::{
+    a11y::{A11yLabel, A11yRole},
+    components::{Node, Style},
+    focus::Focusable,
+    picking::Hovered,
+};
+
+#[derive(Component, Reflect, Default, Clone, Debug)]
+#[reflect(Component)]
+pub struct Button;
+
+#[derive(Message, Debug, Clone, Copy)]
+pub struct OnPress(pub Entity);
+
+impl Button {
+    /// Spawn-ready bundle for a labelled button. Returns `impl Bundle`
+    /// (not `Self`) so callers get the full Phase 0 button contract —
+    /// marker + node + style + focusable + a11y role + a11y label —
+    /// without having to assemble it themselves.
+    #[allow(clippy::new_ret_no_self)]
+    pub fn new(label: impl Into<String>) -> impl Bundle {
+        let label = label.into();
+        (
+            Button,
+            Node,
+            // TODO(buiy-widget-catalog-design): replace hardcoded sizes
+            // (width 120, height 32, padding 8) with size tokens
+            // (e.g. `space.button.width`, `space.2`). The token surface
+            // already exists in buiy_core::theme; Phase 0 keeps numeric
+            // literals only because per-widget size tokens aren't shipped
+            // yet. Hit target 120x32 already meets WCAG 2.5.8 (>=24x24).
+            Style {
+                width: 120.0,
+                height: 32.0,
+                padding: 8.0,
+                border_radius: 6.0, // matches "radius.md"
+                background_token: "color.surface.secondary".into(),
+                foreground_token: "color.text.primary".into(),
+                ..default()
+            },
+            Focusable::default(),
+            A11yRole::Button,
+            A11yLabel(label),
+        )
+    }
+}
+
+// TODO(buiy-widget-catalog-design): Phase 0 fires OnPress on mouse-down
+// (`just_pressed`). WAI-ARIA APG and the web platform fire on mouse-up
+// after press-on-target so users can drag-cancel. Switch to press-down
+// → set "armed" state → release-on-target = OnPress, release-off-target
+// = cancel, in the widget catalog spec.
+//
+// TODO(buiy-widget-catalog-design): Phase 0 ships only mouse activation.
+// APG button contract requires Enter and Space (key down) to also fire
+// OnPress when the button is focused. Wire keyboard activation alongside
+// the full APG keyboard contract in the widget catalog spec.
+pub(crate) fn emit_on_press_on_click(
+    // Both `Hovered` (from `PickingPlugin`) and `ButtonInput<MouseButton>`
+    // (from bevy_input's `InputPlugin`) are owned by sibling plugins that
+    // are not pulled in by every test setup — `MinimalPlugins + CorePlugin`
+    // includes neither. Treat their absence as "nothing to do this frame"
+    // so the system is robust under partial harnesses.
+    hovered: Option<Res<Hovered>>,
+    mouse: Option<Res<ButtonInput<MouseButton>>>,
+    buttons: Query<(), With<Button>>,
+    mut writer: MessageWriter<OnPress>,
+) {
+    let (Some(hovered), Some(mouse)) = (hovered, mouse) else {
+        return;
+    };
+    if !mouse.just_pressed(MouseButton::Left) {
+        return;
+    }
+    let Some(entity) = hovered.0 else {
+        return;
+    };
+    if buttons.get(entity).is_ok() {
+        writer.write(OnPress(entity));
+    }
+}
diff --git a/crates/buiy_widgets/src/lib.rs b/crates/buiy_widgets/src/lib.rs
new file mode 100644
index 0000000..7ec2395
--- /dev/null
+++ b/crates/buiy_widgets/src/lib.rs
@@ -0,0 +1,23 @@
+//! Buiy widgets. Phase 0 ships a single `Button` to validate the
+//! foundation. Full APG widget catalog lives in `buiy-widget-catalog-design`.
+
+use bevy::prelude::*;
+
+pub mod button;
+pub use button::{Button, OnPress};
+
+pub struct WidgetsPlugin;
+
+impl Plugin for WidgetsPlugin {
+    fn build(&self, app: &mut App) {
+        // Bevy 0.18 split buffered events into `Message`; `add_event` was
+        // renamed to `add_message`. `OnPress` is a `Message` so it lives in
+        // `Messages<OnPress>` and is read with `MessageReader` / a cursor.
+        app.register_type::<Button>()
+            .add_message::<OnPress>()
+            .add_systems(
+                Update,
+                button::emit_on_press_on_click.in_set(buiy_core::BuiySet::Input),
+            );
+    }
+}
diff --git a/crates/buiy_widgets/tests/button.rs b/crates/buiy_widgets/tests/button.rs
new file mode 100644
index 0000000..900faf3
--- /dev/null
+++ b/crates/buiy_widgets/tests/button.rs
@@ -0,0 +1,67 @@
+//! Phase 0 contract test: spawning a `Button` attaches role + label +
+//! focusable + a default style; clicking a hovered button emits `OnPress`.
+//!
+//! Bevy 0.18 renamed buffered `Event` → `Message` and `EventWriter`/`EventReader`
+//! → `MessageWriter`/`MessageReader`. Phase 0 leans on the `Message` flavor for
+//! `OnPress` so the test reaches into `Messages<OnPress>` (not `Events<OnPress>`).
+
+use bevy::prelude::*;
+use buiy_core::{
+    CorePlugin,
+    a11y::{A11yLabel, A11yRole},
+    focus::Focusable,
+};
+use buiy_widgets::{Button, OnPress, WidgetsPlugin};
+
+#[test]
+fn spawning_a_button_attaches_role_label_focusable_and_default_style() {
+    let mut app = App::new();
+    app.add_plugins(MinimalPlugins);
+    app.add_plugins(CorePlugin);
+    app.add_plugins(WidgetsPlugin);
+
+    let entity = app.world_mut().spawn(Button::new("Save")).id();
+    app.update();
+
+    let world = app.world();
+    assert!(world.get::<Button>(entity).is_some());
+    assert!(world.get::<Focusable>(entity).is_some());
+    assert_eq!(
+        world.get::<A11yRole>(entity).copied(),
+        Some(A11yRole::Button)
+    );
+    let label = world.get::<A11yLabel>(entity).expect("a11y label");
+    assert_eq!(label.0, "Save");
+}
+
+#[test]
+fn clicking_a_button_emits_on_press() {
+    use buiy_core::picking::Hovered;
+
+    let mut app = App::new();
+    app.add_plugins(MinimalPlugins);
+    app.add_plugins(CorePlugin);
+    app.add_plugins(WidgetsPlugin);
+    // Phase 0 picking lives in CorePlugin; the click handler reads
+    // `Hovered` + `ButtonInput<MouseButton>`. Provide both as resources
+    // since MinimalPlugins doesn't include the input plugin.
+    app.init_resource::<ButtonInput<MouseButton>>();
+
+    let entity = app.world_mut().spawn(Button::new("Save")).id();
+    // Manually mark hovered + simulate a primary mouse press.
+    app.world_mut().insert_resource(Hovered(Some(entity)));
+    app.world_mut()
+        .resource_mut::<ButtonInput<MouseButton>>()
+        .press(MouseButton::Left);
+    app.update();
+
+    let messages = app.world().resource::<Messages<OnPress>>();
+    let mut cursor = messages.get_cursor();
+    let mut found = false;
+    for ev in cursor.read(messages) {
+        if ev.0 == entity {
+            found = true;
+        }
+    }
+    assert!(found, "OnPress message for clicked button");
+}
diff --git a/docs/README.md b/docs/README.md
index 8d3e6ba..ffbecf6 100644
--- a/docs/README.md
+++ b/docs/README.md
@@ -6,7 +6,10 @@ For build/test/dev commands, see `../CLAUDE.md`. This file does not duplicate th
 
 ## Where to start (new agents and humans)
 
-The catalog is empty until the first specs land. As foundational specs are added, link them from this section in reading order so a newcomer can build a conceptual map of the project from the top.
+Reading order for newcomers:
+
+1. [Buiy foundation design](specs/2026-05-07-buiy-foundation/README.md) — the target shape of the library: feature inventory, architectural foundation, sub-spec roadmap. Multi-file folder; start at the README, then read children in the order it lists.
+2. [Docs organization design](specs/2026-05-07-docs-organization-design.md) — how this docs tree is structured.
 
 ## Document types
 
@@ -35,6 +38,22 @@ Areas appear here as soon as there is a real doc to slot under them. Each area i
 
 If a doc spans areas, file it under its primary area only. Reference any adjacent topics in the summary.
 
+### Foundation
+
+**Specs**
+
+- [Buiy foundation design](specs/2026-05-07-buiy-foundation/README.md) — feature inventory, architectural foundation, sub-spec roadmap (multi-file). `[draft]`
+
+**Plans**
+
+- [Phase 0 foundations](plans/2026-05-07-buiy-phase-0-foundations.md) — workspace, BuiyPlugin, system sets, minimal render/layout/a11y/focus/picking/theme, verification harness skeleton, hello-world Button. `[draft]`
+
+### Docs infrastructure
+
+**Specs**
+
+- [Docs organization design](specs/2026-05-07-docs-organization-design.md) — target structure of `docs/`, naming, headers, nesting. `[draft]`
+
 ## Reference designs
 
 Archived design bundles (immutable inputs to specs, not specs themselves) live in [`reference-designs/`](reference-designs/) when they exist.
diff --git a/docs/plans/2026-05-07-buiy-phase-0-foundations.md b/docs/plans/2026-05-07-buiy-phase-0-foundations.md
new file mode 100644
index 0000000..6d28150
--- /dev/null
+++ b/docs/plans/2026-05-07-buiy-phase-0-foundations.md
@@ -0,0 +1,2796 @@
+# Buiy Phase 0 Foundations Implementation Plan
+
+**Date:** 2026-05-07
+**Status:** draft
+**Spec:** [specs/2026-05-07-buiy-foundation/README.md](../specs/2026-05-07-buiy-foundation/README.md)
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Smallest end-to-end "does the architecture work?" Buiy demo: workspace + crates + `BuiyPlugin` + minimal render/layout/a11y/focus/picking/theme + a verification harness + a hello-world Button example, with cross-platform CI green.
+
+**Architecture:** Parallel-to-bevy_ui Bevy plugin. Components in `buiy_core`, widgets in `buiy_widgets`, verification harness in `buiy_verify`, top-level `BuiyPlugin` in `buiy`. Sub-plugin order in Phase 0: `core → theme → a11y → focus → input → widgets`. System sets: `BuiySet::Layout → Style → Input → Animate → Picking → A11yUpdate → Render`. AccessKit adapter is owned per-window keyed by winit `WindowId`. Components derive `Reflect + FromReflect + Default + Clone + Component` and are `register_type`d.
+
+**Tech Stack:** Rust (latest stable), Bevy 0.18+, Taffy for layout, AccessKit + accesskit_winit for a11y, bevy_picking for hit-testing, wgpu via Bevy render graph, image-compare for visual regression, proptest for property tests.
+
+**Phase 0 explicitly out of scope:** rich text + IME (cosmic-text comes later), animation system, forms/validation, devtools, BSN authoring, multiple widgets, 3D-anchored UI. Each becomes its own sub-spec + plan.
+
+**Bevy version note:** Bevy 0.18+ APIs shift between minors. Where this plan shows specific Bevy API calls, the engineer must verify against the in-tree Bevy version's documentation; minor adjustments to plugin / render-graph / SystemSet construction may be required. The architectural decisions (per-window adapter, render-graph node ordering, system-set names) are stable.
+
+---
+
+## Spec coverage map
+
+Each Phase 0 task maps to specific commitments in the foundation spec:
+
+| Foundation-spec commitment | Phase 0 task |
+|---|---|
+| Crate workspace partition (architecture.md § 2.8) | Task 1 |
+| `BuiySet::Layout / Style / Input / Animate / Picking / A11yUpdate / Render` ordering | Task 4 |
+| Components derive `Reflect + FromReflect + Default + Clone + Component`, `register_type`d | Task 5 |
+| Token-based theming, OS-pref `UserPreferences` resource | Task 6 |
+| Taffy integration, `BuiySet::Layout` | Task 7 |
+| Focus tree, `:focus-visible` semantics, Tab handling, focus ring | Task 8 |
+| AccessKit adapter ownership per-window keyed by `WindowId`, `bevy_a11y` replaced | Task 9 |
+| `bevy_picking` backend registration, per-window filtered | Task 10 |
+| Custom render pipeline (rounded clipping foundations, top-layer hooks) | Tasks 11–13 |
+| Sub-plugin order in `BuiyPlugin` | Tasks 14, 15 |
+| Verification harness (`buiy_verify`) | Tasks 16–19 |
+| CI on Windows / macOS / Linux desktop | Task 22 |
+| Visual regression CI gate (gate #2) | Task 17 |
+| AccessKit tree snapshot CI gate (gate #3) | Task 18 |
+| Contrast linter CI gate (gate #9) | Task 19 |
+| Hot-reload validation (gate #13), perf regression (gate #14), memory leak (gate #15) — **deferred** beyond Phase 0; their crates are scaffolded but not exercised |
+
+Non-CI gate categories deferred beyond Phase 0: announcement-output snapshots (gate #4), forced-colors compatibility scan (gate #11), hit-target linter (gate #10), property tests / fuzzing (gate #12). Spec calls them out as committed, but Phase 0's job is to prove the architecture, not to ship the full verification suite.
+
+---
+
+## Task 1: Workspace scaffolding
+
+**Files:**
+- Create: `Cargo.toml` (workspace root)
+- Create: `rust-toolchain.toml`
+- Create: `rustfmt.toml`
+- Create: `clippy.toml`
+- Modify: `.gitignore` (add Rust artifacts)
+
+- [ ] **Step 1: Write the failing test**
+
+Create `tests/workspace_smoke.rs`:
+
+```rust
+#[test]
+fn workspace_builds() {
+    // This is a compile-time assertion that the workspace is well-formed.
+    // If this file compiles, the workspace is valid.
+}
+```
+
+- [ ] **Step 2: Run test to verify it fails**
+
+Run: `cargo build --workspace`
+Expected: FAIL with "no Cargo.toml found" or similar.
+
+- [ ] **Step 3: Create the workspace**
+
+Create `Cargo.toml`:
+
+```toml
+[workspace]
+resolver = "2"
+members = [
+    "crates/buiy",
+    "crates/buiy_core",
+    "crates/buiy_widgets",
+    "crates/buiy_verify",
+    "examples/hello_button",
+]
+
+[workspace.package]
+version = "0.0.1"
+edition = "2024"
+license = "MIT OR Apache-2.0"
+repository = "https://github.com/intendednull/buiy"
+rust-version = "1.85"
+
+[workspace.dependencies]
+bevy = { version = "0.18", default-features = false, features = ["bevy_render", "bevy_winit", "bevy_window", "bevy_asset", "bevy_log", "x11", "wayland"] }
+bevy_picking = "0.18"
+taffy = "0.10"
+accesskit = "0.24"
+accesskit_winit = "0.32"
+serde = { version = "1", features = ["derive"] }
+serde_json = "1"
+image = "0.25"
+image-compare = "0.6"
+proptest = "1"
+thiserror = "2"
+tracing = "0.1"
+```
+
+Versions are indicative for May 2026; the engineer must verify against current crates.io and pin compatible versions. The `accesskit` and `accesskit_winit` versions must match what Bevy's a11y crate pins, OR the spec's parallel architecture means we own the version directly — whichever is current with Bevy 0.18.
+
+Create `rust-toolchain.toml`:
+
+```toml
+[toolchain]
+channel = "stable"
+components = ["rustfmt", "clippy"]
+```
+
+Create `rustfmt.toml`:
+
+```toml
+edition = "2024"
+# imports_granularity = "Module" and group_imports = "StdExternalCrate" are
+# nightly-only on rustfmt as of stable 1.x. Re-enable if the project later
+# moves fmt to nightly.
+```
+
+Create `clippy.toml`:
+
+```toml
+disallowed-methods = []
+```
+
+Modify `.gitignore` — append:
+
+```
+target/
+Cargo.lock
+```
+
+(`Cargo.lock` is omitted from version control because Buiy is a library workspace; `examples/hello_button` may want to commit its own Cargo.lock — that's a future decision. For Phase 0, exclude.)
+
+- [ ] **Step 4: Run test to verify it passes**
+
+Run: `cargo build --workspace`
+Expected: builds (with warnings about empty crates that will be filled in by later tasks). If it fails because member crates don't exist yet, create empty `crates/<name>/Cargo.toml` and `crates/<name>/src/lib.rs` with `pub fn _placeholder() {}` so the workspace resolves; later tasks replace these.
+
+Run: `cargo test --workspace`
+Expected: PASS (the empty test from Step 1 passes).
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add Cargo.toml rust-toolchain.toml rustfmt.toml clippy.toml .gitignore tests/workspace_smoke.rs
+git add crates/*/Cargo.toml crates/*/src/lib.rs examples/*/Cargo.toml examples/*/src/main.rs
+git commit -m "chore: bootstrap Buiy workspace and crate scaffolding"
+```
+
+---
+
+## Task 2: `buiy_core` crate skeleton with `CorePlugin`
+
+**Files:**
+- Modify: `crates/buiy_core/Cargo.toml`
+- Modify: `crates/buiy_core/src/lib.rs`
+- Create: `crates/buiy_core/tests/plugin_smoke.rs`
+
+- [ ] **Step 1: Write the failing test**
+
+Create `crates/buiy_core/tests/plugin_smoke.rs`:
+
+```rust
+use bevy::prelude::*;
+use buiy_core::CorePlugin;
+
+#[test]
+fn core_plugin_loads_without_panic() {
+    let mut app = App::new();
+    app.add_plugins(MinimalPlugins);
+    app.add_plugins(CorePlugin);
+    app.update();
+}
+```
+
+- [ ] **Step 2: Run test to verify it fails**
+
+Run: `cargo test -p buiy_core --test plugin_smoke`
+Expected: FAIL — `CorePlugin` does not exist.
+
+- [ ] **Step 3: Implement `CorePlugin`**
+
+Replace `crates/buiy_core/Cargo.toml`:
+
+```toml
+[package]
+name = "buiy_core"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+
+[dependencies]
+bevy.workspace = true
+taffy.workspace = true
+accesskit.workspace = true
+accesskit_winit.workspace = true
+bevy_picking.workspace = true
+thiserror.workspace = true
+tracing.workspace = true
+```
+
+Replace `crates/buiy_core/src/lib.rs`:
+
+```rust
+//! Buiy core: components, plugin scaffolding, system sets.
+//!
+//! See: docs/specs/2026-05-07-buiy-foundation/architecture.md § 2.8 for
+//! sub-plugin order and SystemSet definitions.
+
+use bevy::prelude::*;
+
+/// Top-level system sets for Buiy. Order: Layout → Style → Input → Animate
+/// → Picking → A11yUpdate → Render.
+#[derive(SystemSet, Debug, Clone, Copy, Eq, PartialEq, Hash)]
+pub enum BuiySet {
+    Layout,
+    Style,
+    Input,
+    Animate,
+    Picking,
+    A11yUpdate,
+    Render,
+}
+
+/// Core Buiy plugin: registers types, configures system sets.
+/// Composed into `BuiyPlugin` from the meta-crate; not consumed directly
+/// by end users.
+pub struct CorePlugin;
+
+impl Plugin for CorePlugin {
+    fn build(&self, app: &mut App) {
+        app.configure_sets(
+            Update,
+            (
+                BuiySet::Layout,
+                BuiySet::Style,
+                BuiySet::Input,
+                BuiySet::Animate,
+                BuiySet::Picking,
+                BuiySet::A11yUpdate,
+                BuiySet::Render,
+            )
+                .chain(),
+        );
+    }
+}
+```
+
+- [ ] **Step 4: Run test to verify it passes**
+
+Run: `cargo test -p buiy_core --test plugin_smoke`
+Expected: PASS.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add crates/buiy_core/Cargo.toml crates/buiy_core/src/lib.rs crates/buiy_core/tests/plugin_smoke.rs
+git commit -m "feat(core): scaffold CorePlugin and BuiySet system sets"
+```
+
+---
+
+## Task 3: `Node` and `Style` components
+
+**Files:**
+- Create: `crates/buiy_core/src/components.rs`
+- Modify: `crates/buiy_core/src/lib.rs` (mod components, register types)
+- Create: `crates/buiy_core/tests/components.rs`
+
+- [ ] **Step 1: Write the failing test**
+
+Create `crates/buiy_core/tests/components.rs`:
+
+```rust
+use bevy::prelude::*;
+use bevy::reflect::TypeRegistry;
+use buiy_core::{components::*, CorePlugin};
+
+#[test]
+fn node_and_style_are_registered_and_default_constructible() {
+    let mut app = App::new();
+    app.add_plugins(MinimalPlugins);
+    app.add_plugins(CorePlugin);
+
+    let registry = app.world().resource::<AppTypeRegistry>();
+    let registry = registry.read();
+    assert!(registry.get(std::any::TypeId::of::<Node>()).is_some(),
+        "Node not registered");
+    assert!(registry.get(std::any::TypeId::of::<Style>()).is_some(),
+        "Style not registered");
+    assert!(registry.get(std::any::TypeId::of::<ResolvedLayout>()).is_some(),
+        "ResolvedLayout not registered");
+
+    drop(registry);
+    let mut world = app.world_mut();
+    let entity = world.spawn((Node::default(), Style::default())).id();
+    assert!(world.get::<Node>(entity).is_some());
+    assert!(world.get::<Style>(entity).is_some());
+}
+```
+
+- [ ] **Step 2: Run test to verify it fails**
+
+Run: `cargo test -p buiy_core --test components`
+Expected: FAIL — `Node`, `Style`, `ResolvedLayout` not in `components` module.
+
+- [ ] **Step 3: Define the components**
+
+Create `crates/buiy_core/src/components.rs`:
+
+```rust
+//! Buiy's core component types.
+//!
+//! Every Buiy component is small, public-fielded, observable, and decomposed
+//! by concern. Every component derives `Reflect + FromReflect + Default +
+//! Clone + Component`. See: docs/specs/2026-05-07-buiy-foundation/architecture.md § 2.4.
+
+use bevy::prelude::*;
+
+/// A Buiy node — the parallel-to-bevy_ui::Node primitive. Marker that this
+/// entity participates in Buiy's layout / render / a11y trees.
+#[derive(Component, Reflect, FromReflect, Default, Clone, Debug)]
+#[reflect(Component)]
+pub struct Node;
+
+/// Box-model + layout style. Not exhaustive in Phase 0 — only the surface
+/// the layout system reads.
+#[derive(Component, Reflect, FromReflect, Default, Clone, Debug)]
+#[reflect(Component)]
+pub struct Style {
+    /// Width in logical pixels. 0.0 = auto.
+    pub width: f32,
+    /// Height in logical pixels. 0.0 = auto.
+    pub height: f32,
+    /// Padding on all sides.
+    pub padding: f32,
+    /// Margin on all sides.
+    pub margin: f32,
+    /// Border radius (uniform; per-corner is a later sub-spec).
+    pub border_radius: f32,
+    /// Flex direction. 0 = Row, 1 = Column. Mapped to Taffy in `layout.rs`.
+    pub flex_direction: u8,
+    /// Token reference for background color (e.g., "color.surface.primary").
+    pub background_token: String,
+    /// Token reference for foreground/text color.
+    pub foreground_token: String,
+}
+
+/// Resolved layout output, written by the layout system in `BuiySet::Layout`.
+/// Read by render and picking in subsequent sets.
+#[derive(Component, Reflect, FromReflect, Default, Clone, Debug)]
+#[reflect(Component)]
+pub struct ResolvedLayout {
+    /// Top-left position in logical pixels (window-relative).
+    pub position: Vec2,
+    /// Size in logical pixels.
+    pub size: Vec2,
+}
+```
+
+Modify `crates/buiy_core/src/lib.rs` — add `mod components;` and `pub use` plus type registration in `CorePlugin::build`:
+
+```rust
+//! Buiy core: components, plugin scaffolding, system sets.
+
+use bevy::prelude::*;
+
+pub mod components;
+
+pub use components::{Node, Style, ResolvedLayout};
+
+#[derive(SystemSet, Debug, Clone, Copy, Eq, PartialEq, Hash)]
+pub enum BuiySet {
+    Layout, Style, Input, Animate, Picking, A11yUpdate, Render,
+}
+
+pub struct CorePlugin;
+
+impl Plugin for CorePlugin {
+    fn build(&self, app: &mut App) {
+        app.register_type::<Node>()
+            .register_type::<Style>()
+            .register_type::<ResolvedLayout>()
+            .configure_sets(
+                Update,
+                (
+                    BuiySet::Layout, BuiySet::Style, BuiySet::Input,
+                    BuiySet::Animate, BuiySet::Picking,
+                    BuiySet::A11yUpdate, BuiySet::Render,
+                ).chain(),
+            );
+    }
+}
+```
+
+- [ ] **Step 4: Run test to verify it passes**
+
+Run: `cargo test -p buiy_core --test components`
+Expected: PASS.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add crates/buiy_core/src/components.rs crates/buiy_core/src/lib.rs crates/buiy_core/tests/components.rs
+git commit -m "feat(core): add Node, Style, ResolvedLayout components"
+```
+
+---
+
+## Task 4: `Theme` resource + tokens + `UserPreferences`
+
+**Files:**
+- Create: `crates/buiy_core/src/theme.rs`
+- Modify: `crates/buiy_core/src/lib.rs` (mod theme, register, expose `ThemePlugin`)
+- Create: `crates/buiy_core/tests/theme.rs`
+
+- [ ] **Step 1: Write the failing test**
+
+Create `crates/buiy_core/tests/theme.rs`:
+
+```rust
+use bevy::prelude::*;
+use buiy_core::theme::{Theme, UserPreferences, default_light_theme};
+
+#[test]
+fn default_theme_resolves_known_tokens() {
+    let theme = default_light_theme();
+    let bg = theme.color("color.surface.primary").expect("primary surface");
+    let fg = theme.color("color.text.primary").expect("primary text");
+    assert!(bg != fg, "fg and bg must differ");
+    let space_4 = theme.space("space.4").expect("space.4");
+    assert!(space_4 > 0.0);
+}
+
+#[test]
+fn user_preferences_default_to_light_no_reduce_motion() {
+    let prefs = UserPreferences::default();
+    assert!(!prefs.prefers_dark);
+    assert!(!prefs.prefers_reduced_motion);
+    assert!(!prefs.forced_colors);
+}
+```
+
+- [ ] **Step 2: Run test to verify it fails**
+
+Run: `cargo test -p buiy_core --test theme`
+Expected: FAIL — `theme` module does not exist.
+
+- [ ] **Step 3: Implement theme**
+
+Create `crates/buiy_core/src/theme.rs`:
+
+```rust
+//! Token-based theming.
+//!
+//! See: docs/specs/2026-05-07-buiy-foundation/architecture.md § 2.5 and
+//! cross-cutting.md § 3.14. Phase 0 ships a minimal token surface — the
+//! full token taxonomy lives in `buiy-theme-tokens-design`.
+
+use bevy::prelude::*;
+use std::collections::HashMap;
+
+/// A single theme variant. Phase 0 stores tokens as flat string-keyed maps.
+/// The full token system replaces this with typed scales in
+/// `buiy-theme-tokens-design`.
+#[derive(Resource, Reflect, Clone, Debug, Default)]
+#[reflect(Resource)]
+pub struct Theme {
+    pub colors: HashMap<String, Color>,
+    pub spaces: HashMap<String, f32>,
+    pub radii: HashMap<String, f32>,
+}
+
+impl Theme {
+    pub fn color(&self, token: &str) -> Option<Color> {
+        self.colors.get(token).copied()
+    }
+    pub fn space(&self, token: &str) -> Option<f32> {
+        self.spaces.get(token).copied()
+    }
+    pub fn radius(&self, token: &str) -> Option<f32> {
+        self.radii.get(token).copied()
+    }
+}
+
+/// OS preference resource. Updated by a system in BuiySet::Input that reads
+/// from winit (or platform-specific sources). Phase 0 populates with
+/// defaults; full OS-pref plumbing is `buiy-clipboard-and-os-integration-design`.
+#[derive(Resource, Reflect, Clone, Debug, Default)]
+#[reflect(Resource)]
+pub struct UserPreferences {
+    pub prefers_dark: bool,
+    pub prefers_reduced_motion: bool,
+    pub prefers_reduced_transparency: bool,
+    pub prefers_more_contrast: bool,
+    pub forced_colors: bool,
+    pub inverted_colors: bool,
+}
+
+/// Default light theme. Phase 0 is intentionally bare; v1 ships a full token
+/// scale set validated against WCAG 2.2 AA in CI.
+pub fn default_light_theme() -> Theme {
+    let mut t = Theme::default();
+    t.colors.insert("color.surface.primary".into(), Color::WHITE);
+    t.colors.insert("color.surface.secondary".into(), Color::srgb(0.96, 0.96, 0.96));
+    t.colors.insert("color.text.primary".into(), Color::srgb(0.10, 0.10, 0.10));
+    t.colors.insert("color.text.secondary".into(), Color::srgb(0.40, 0.40, 0.40));
+    t.colors.insert("color.accent".into(), Color::srgb(0.20, 0.45, 0.95));
+    t.colors.insert("color.focus.ring".into(), Color::srgb(0.20, 0.45, 0.95));
+
+    t.spaces.insert("space.0".into(), 0.0);
+    t.spaces.insert("space.1".into(), 4.0);
+    t.spaces.insert("space.2".into(), 8.0);
+    t.spaces.insert("space.3".into(), 12.0);
+    t.spaces.insert("space.4".into(), 16.0);
+
+    t.radii.insert("radius.sm".into(), 2.0);
+    t.radii.insert("radius.md".into(), 6.0);
+    t.radii.insert("radius.lg".into(), 12.0);
+    t
+}
+
+pub struct ThemePlugin;
+
+impl Plugin for ThemePlugin {
+    fn build(&self, app: &mut App) {
+        app.register_type::<Theme>()
+            .register_type::<UserPreferences>()
+            .insert_resource(default_light_theme())
+            .insert_resource(UserPreferences::default());
+    }
+}
+```
+
+Modify `crates/buiy_core/src/lib.rs` — add `pub mod theme;`. Do NOT add `ThemePlugin` to `CorePlugin`; the meta-crate (`buiy`) composes them in the documented order.
+
+- [ ] **Step 4: Run test to verify it passes**
+
+Run: `cargo test -p buiy_core --test theme`
+Expected: PASS.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add crates/buiy_core/src/theme.rs crates/buiy_core/src/lib.rs crates/buiy_core/tests/theme.rs
+git commit -m "feat(core): add Theme resource, default light theme, UserPreferences"
+```
+
+---
+
+## Task 5: Layout via Taffy
+
+**Files:**
+- Create: `crates/buiy_core/src/layout.rs`
+- Modify: `crates/buiy_core/src/lib.rs` (mod layout)
+- Create: `crates/buiy_core/tests/layout.rs`
+
+- [ ] **Step 1: Write the failing test**
+
+Create `crates/buiy_core/tests/layout.rs`:
+
+```rust
+use bevy::prelude::*;
+use buiy_core::{
+    components::{Node, ResolvedLayout, Style},
+    layout::LayoutPlugin,
+    CorePlugin,
+};
+
+#[test]
+fn layout_resolves_a_simple_flex_row() {
+    let mut app = App::new();
+    app.add_plugins(MinimalPlugins);
+    app.add_plugins(CorePlugin);
+    app.add_plugins(LayoutPlugin);
+
+    let parent = app.world_mut().spawn((
+        Node,
+        Style { width: 200.0, height: 100.0, flex_direction: 0, ..default() },
+    )).id();
+
+    let child = app.world_mut().spawn((
+        Node,
+        Style { width: 50.0, height: 50.0, ..default() },
+    )).id();
+
+    app.world_mut().entity_mut(parent).add_child(child);
+
+    app.update(); // run BuiySet::Layout
+
+    let layout = app.world().get::<ResolvedLayout>(child)
+        .expect("child has ResolvedLayout after Update");
+    assert!((layout.size.x - 50.0).abs() < 0.5, "child width ≈ 50");
+    assert!((layout.size.y - 50.0).abs() < 0.5, "child height ≈ 50");
+}
+```
+
+- [ ] **Step 2: Run test to verify it fails**
+
+Run: `cargo test -p buiy_core --test layout`
+Expected: FAIL — `LayoutPlugin` not defined.
+
+- [ ] **Step 3: Implement layout**
+
+Create `crates/buiy_core/src/layout.rs`:
+
+```rust
+//! Layout via Taffy.
+//!
+//! See: docs/specs/2026-05-07-buiy-foundation/visuals.md § 3.2 and
+//! architecture.md § 2.3. Phase 0 supports flex row/column with fixed
+//! width/height; the full layout surface lives in `buiy-layout-design`.
+
+use crate::{components::{Node, ResolvedLayout, Style}, BuiySet};
+use bevy::prelude::*;
+use std::collections::HashMap;
+use taffy::{
+    AvailableSpace, Dimension, FlexDirection, NodeId as TaffyNodeId, Size,
+    Style as TaffyStyle, TaffyTree, TraversePartialTree,
+};
+
+/// Resource: maps Bevy `Entity` to Taffy node IDs. Reused across frames to
+/// keep Taffy's internal cache warm.
+#[derive(Resource, Default)]
+pub struct LayoutTree {
+    tree: TaffyTree<()>,
+    by_entity: HashMap<Entity, TaffyNodeId>,
+}
+
+pub struct LayoutPlugin;
+
+impl Plugin for LayoutPlugin {
+    fn build(&self, app: &mut App) {
+        app.init_resource::<LayoutTree>()
+            .add_systems(Update, sync_and_compute_layout.in_set(BuiySet::Layout));
+    }
+}
+
+fn style_to_taffy(style: &Style) -> TaffyStyle {
+    TaffyStyle {
+        size: Size {
+            width: if style.width > 0.0 { Dimension::Length(style.width) } else { Dimension::Auto },
+            height: if style.height > 0.0 { Dimension::Length(style.height) } else { Dimension::Auto },
+        },
+        flex_direction: if style.flex_direction == 1 { FlexDirection::Column } else { FlexDirection::Row },
+        ..Default::default()
+    }
+}
+
+/// One pass: ensure every Buiy entity has a Taffy node, sync style, compute
+/// layout starting from roots (entities with `Node` and no Buiy parent),
+/// write `ResolvedLayout` back.
+fn sync_and_compute_layout(
+    mut commands: Commands,
+    mut tree: ResMut<LayoutTree>,
+    nodes: Query<(Entity, &Style, Option<&Parent>, Option<&Children>), With<Node>>,
+    windows: Query<&bevy::window::Window>,
+) {
+    // Ensure every Buiy entity has a Taffy node + current style.
+    for (entity, style, _parent, _children) in nodes.iter() {
+        let taffy_style = style_to_taffy(style);
+        match tree.by_entity.get(&entity).copied() {
+            Some(id) => { let _ = tree.tree.set_style(id, taffy_style); }
+            None => {
+                let id = tree.tree.new_leaf(taffy_style).expect("new_leaf");
+                tree.by_entity.insert(entity, id);
+            }
+        }
+    }
+
+    // Sync child relationships for each Buiy entity.
+    for (entity, _style, _parent, children) in nodes.iter() {
+        let parent_id = match tree.by_entity.get(&entity).copied() {
+            Some(id) => id, None => continue,
+        };
+        let child_ids: Vec<TaffyNodeId> = children
+            .into_iter()
+            .flatten()
+            .filter_map(|c| tree.by_entity.get(c).copied())
+            .collect();
+        let _ = tree.tree.set_children(parent_id, &child_ids);
+    }
+
+    // Compute layout for roots (entities with Node and no Buiy parent).
+    let window_size = windows
+        .iter()
+        .next()
+        .map(|w| Vec2::new(w.width(), w.height()))
+        .unwrap_or(Vec2::new(800.0, 600.0));
+
+    for (entity, _style, parent, _children) in nodes.iter() {
+        let is_root = parent.map(|p| !tree.by_entity.contains_key(&p.get())).unwrap_or(true);
+        if !is_root { continue; }
+        if let Some(id) = tree.by_entity.get(&entity).copied() {
+            let _ = tree.tree.compute_layout(
+                id,
+                Size {
+                    width: AvailableSpace::Definite(window_size.x),
+                    height: AvailableSpace::Definite(window_size.y),
+                },
+            );
+        }
+    }
+
+    // Walk the tree and write ResolvedLayout for every entity.
+    let mut to_write: Vec<(Entity, ResolvedLayout)> = Vec::new();
+    for (&entity, &id) in tree.by_entity.iter() {
+        if let Ok(layout) = tree.tree.layout(id) {
+            to_write.push((entity, ResolvedLayout {
+                position: Vec2::new(layout.location.x, layout.location.y),
+                size: Vec2::new(layout.size.width, layout.size.height),
+            }));
+        }
+    }
+    for (e, rl) in to_write {
+        commands.entity(e).insert(rl);
+    }
+}
+```
+
+Add `pub mod layout;` and `pub use layout::LayoutPlugin;` to `crates/buiy_core/src/lib.rs`.
+
+> **Note for executor:** Taffy 0.10's API is the reference; minor rev shifts often. If `set_children` / `new_leaf` / `compute_layout` signatures differ, adjust to current Taffy API. The architectural commitment (one Taffy tree per app, entity-keyed mapping, layout in `BuiySet::Layout`) does not change.
+
+- [ ] **Step 4: Run test to verify it passes**
+
+Run: `cargo test -p buiy_core --test layout`
+Expected: PASS.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add crates/buiy_core/src/layout.rs crates/buiy_core/src/lib.rs crates/buiy_core/tests/layout.rs
+git commit -m "feat(core): integrate Taffy for layout in BuiySet::Layout"
+```
+
+---
+
+## Task 6: Focus model — `Focusable` + Tab handling
+
+**Files:**
+- Create: `crates/buiy_core/src/focus.rs`
+- Modify: `crates/buiy_core/src/lib.rs` (mod focus)
+- Create: `crates/buiy_core/tests/focus.rs`
+
+- [ ] **Step 1: Write the failing test**
+
+Create `crates/buiy_core/tests/focus.rs`:
+
+```rust
+use bevy::prelude::*;
+use buiy_core::{focus::{advance_focus_for_test, FocusPlugin, Focusable, FocusedEntity}, CorePlugin};
+
+#[test]
+fn tab_cycles_focus_through_focusables() {
+    let mut app = App::new();
+    app.add_plugins(MinimalPlugins);
+    app.add_plugins(CorePlugin);
+    app.add_plugins(FocusPlugin);
+
+    let a = app.world_mut().spawn(Focusable::default()).id();
+    let b = app.world_mut().spawn(Focusable::default()).id();
+    let c = app.world_mut().spawn(Focusable::default()).id();
+
+    advance_focus_for_test(&mut app, true);
+    assert_eq!(app.world().resource::<FocusedEntity>().0, Some(a));
+    advance_focus_for_test(&mut app, true);
+    assert_eq!(app.world().resource::<FocusedEntity>().0, Some(b));
+    advance_focus_for_test(&mut app, true);
+    assert_eq!(app.world().resource::<FocusedEntity>().0, Some(c));
+    advance_focus_for_test(&mut app, true);
+    assert_eq!(app.world().resource::<FocusedEntity>().0, Some(a),
+        "wraps to first focusable");
+
+    advance_focus_for_test(&mut app, false);
+    assert_eq!(app.world().resource::<FocusedEntity>().0, Some(c),
+        "Shift+Tab moves backward");
+}
+```
+
+- [ ] **Step 2: Run test to verify it fails**
+
+Run: `cargo test -p buiy_core --test focus`
+Expected: FAIL — `focus` module does not exist.
+
+- [ ] **Step 3: Implement focus**
+
+Create `crates/buiy_core/src/focus.rs`:
+
+```rust
+//! Focus model: focus tree, Tab handling, focus-visible heuristic, focus
+//! restoration. Phase 0 implements ordered Tab traversal; full focus tree
+//! (roving tabindex, aria-activedescendant, traps, restoration, spatial nav)
+//! lives in `buiy-focus-model-design`.
+//!
+//! See: docs/specs/2026-05-07-buiy-foundation/architecture.md § 2.3 and
+//! accessibility.md (Focus management).
+
+use crate::BuiySet;
+use bevy::prelude::*;
+
+/// Marks an entity as part of the focus tree.
+#[derive(Component, Reflect, FromReflect, Default, Clone, Debug)]
+#[reflect(Component)]
+pub struct Focusable {
+    /// Phase 0: 0 = Auto (in document order); negative = Skip; positive = explicit.
+    pub tab_order: i32,
+}
+
+/// Currently focused entity (None = nothing focused).
+#[derive(Resource, Reflect, Default, Clone, Debug)]
+#[reflect(Resource)]
+pub struct FocusedEntity(pub Option<Entity>);
+
+/// Tracks whether the most recent focus change was keyboard / programmatic
+/// (true) or pointer (false). Drives the `:focus-visible` heuristic — focus
+/// rings render only when this is true.
+#[derive(Resource, Reflect, Default, Clone, Debug)]
+#[reflect(Resource)]
+pub struct FocusVisible(pub bool);
+
+pub struct FocusPlugin;
+
+impl Plugin for FocusPlugin {
+    fn build(&self, app: &mut App) {
+        app.register_type::<Focusable>()
+            .register_type::<FocusedEntity>()
+            .register_type::<FocusVisible>()
+            .init_resource::<FocusedEntity>()
+            .init_resource::<FocusVisible>()
+            .add_systems(Update, handle_tab.in_set(BuiySet::Input));
+    }
+}
+
+fn handle_tab(
+    keys: Res<ButtonInput<KeyCode>>,
+    focusables: Query<(Entity, &Focusable)>,
+    mut focused: ResMut<FocusedEntity>,
+    mut visible: ResMut<FocusVisible>,
+) {
+    let pressed_tab = keys.just_pressed(KeyCode::Tab);
+    if !pressed_tab { return; }
+    let forward = !keys.pressed(KeyCode::ShiftLeft) && !keys.pressed(KeyCode::ShiftRight);
+    advance_focus(&focusables, &mut focused, forward);
+    visible.0 = true;
+}
+
+/// Test-friendly helper: advance focus without needing an input event loop.
+pub fn advance_focus_for_test(app: &mut App, forward: bool) {
+    let focusables: Vec<(Entity, Focusable)> = app
+        .world_mut()
+        .query::<(Entity, &Focusable)>()
+        .iter(app.world())
+        .map(|(e, f)| (e, f.clone()))
+        .collect();
+    let mut focused = app.world_mut().resource_mut::<FocusedEntity>();
+    let prev = focused.0;
+    let next = compute_next_focus(&focusables, prev, forward);
+    focused.0 = next;
+    app.world_mut().resource_mut::<FocusVisible>().0 = true;
+}
+
+fn advance_focus(
+    focusables: &Query<(Entity, &Focusable)>,
+    focused: &mut FocusedEntity,
+    forward: bool,
+) {
+    let entries: Vec<(Entity, Focusable)> = focusables.iter().map(|(e, f)| (e, f.clone())).collect();
+    focused.0 = compute_next_focus(&entries, focused.0, forward);
+}
+
+fn compute_next_focus(
+    focusables: &[(Entity, Focusable)],
+    current: Option<Entity>,
+    forward: bool,
+) -> Option<Entity> {
+    let mut entries: Vec<(Entity, Focusable)> = focusables
+        .iter()
+        .filter(|(_, f)| f.tab_order >= 0)
+        .cloned()
+        .collect();
+    if entries.is_empty() { return None; }
+    // Sort: explicit positive tab_order first (ascending), then Auto (0) in document order.
+    entries.sort_by_key(|(e, f)| (if f.tab_order > 0 { 0 } else { 1 }, f.tab_order, e.index()));
+
+    let idx = current
+        .and_then(|e| entries.iter().position(|(x, _)| *x == e));
+    let n = entries.len();
+    let next_idx = match (idx, forward) {
+        (None, true) => 0,
+        (None, false) => n - 1,
+        (Some(i), true) => (i + 1) % n,
+        (Some(i), false) => (i + n - 1) % n,
+    };
+    Some(entries[next_idx].0)
+}
+```
+
+Add `pub mod focus;` and `pub use focus::{FocusPlugin, Focusable, FocusedEntity, FocusVisible};` to `crates/buiy_core/src/lib.rs`.
+
+- [ ] **Step 4: Run test to verify it passes**
+
+Run: `cargo test -p buiy_core --test focus`
+Expected: PASS.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add crates/buiy_core/src/focus.rs crates/buiy_core/src/lib.rs crates/buiy_core/tests/focus.rs
+git commit -m "feat(core): add Focusable + FocusPlugin with Tab handling"
+```
+
+---
+
+## Task 7: A11y components + AccessKit adapter
+
+**Files:**
+- Create: `crates/buiy_core/src/a11y.rs`
+- Modify: `crates/buiy_core/src/lib.rs` (mod a11y)
+- Create: `crates/buiy_core/tests/a11y.rs`
+
+- [ ] **Step 1: Write the failing test**
+
+Create `crates/buiy_core/tests/a11y.rs`:
+
+```rust
+use bevy::prelude::*;
+use buiy_core::{
+    a11y::{A11yLabel, A11yPlugin, A11yRole, A11yTreeBuilder},
+    focus::Focusable,
+    CorePlugin,
+};
+
+#[test]
+fn tree_builder_emits_one_node_per_focusable_with_role_and_label() {
+    let mut app = App::new();
+    app.add_plugins(MinimalPlugins);
+    app.add_plugins(CorePlugin);
+    app.add_plugins(A11yPlugin);
+
+    let _btn = app.world_mut().spawn((
+        Focusable::default(),
+        A11yRole::Button,
+        A11yLabel("Save".to_string()),
+    )).id();
+
+    app.update();
+
+    let builder = app.world().resource::<A11yTreeBuilder>();
+    let snapshot = builder.snapshot();
+    let count = snapshot.iter()
+        .filter(|n| n.role == A11yRole::Button)
+        .count();
+    assert_eq!(count, 1, "exactly one button node in tree");
+    let names: Vec<String> = snapshot.iter().map(|n| n.name.clone()).collect();
+    assert!(names.contains(&"Save".to_string()), "Save name present");
+}
+```
+
+- [ ] **Step 2: Run test to verify it fails**
+
+Run: `cargo test -p buiy_core --test a11y`
+Expected: FAIL.
+
+- [ ] **Step 3: Implement a11y**
+
+Create `crates/buiy_core/src/a11y.rs`:
+
+```rust
+//! AccessKit integration. Phase 0 builds an in-memory snapshot and exposes
+//! an `A11yTreeBuilder` that can be serialized for snapshot tests; the real
+//! `accesskit_winit::Adapter` wiring per-window happens once Bevy windows
+//! are introduced (Task 14, BuiyPlugin).
+//!
+//! See: docs/specs/2026-05-07-buiy-foundation/architecture.md § 2.6 and
+//! accessibility.md § 3.11 (decomposed components per #17644).
+
+use crate::{focus::Focusable, BuiySet};
+use bevy::prelude::*;
+
+/// Decomposed AccessKit role component.
+#[derive(Component, Reflect, FromReflect, Clone, Copy, Debug, PartialEq, Eq, Default)]
+#[reflect(Component)]
+pub enum A11yRole {
+    #[default]
+    Generic,
+    Button,
+    Link,
+    Image,
+    Text,
+    Heading,
+    Dialog,
+    AlertDialog,
+    Tooltip,
+    // Phase 0 stops here; full taxonomy is in the foundation spec accessibility.md.
+}
+
+/// Decomposed accessible name. ACCNAME 1.2 computation is in `buiy-accessibility-design`;
+/// Phase 0 is the literal-string fast path.
+#[derive(Component, Reflect, FromReflect, Clone, Debug, Default)]
+#[reflect(Component)]
+pub struct A11yLabel(pub String);
+
+/// Decomposed accessible description.
+#[derive(Component, Reflect, FromReflect, Clone, Debug, Default)]
+#[reflect(Component)]
+pub struct A11yDescription(pub String);
+
+/// One node in the tree as Buiy sees it. Will be translated into
+/// `accesskit::Node` by the adapter in Task 14. Decoupled here so we can
+/// snapshot it without needing a winit window.
+#[derive(Clone, Debug, PartialEq)]
+pub struct A11yNodeView {
+    pub entity: Entity,
+    pub role: A11yRole,
+    pub name: String,
+    pub description: String,
+    pub focusable: bool,
+}
+
+/// Tree builder: rebuilt each frame from changed components in BuiySet::A11yUpdate.
+#[derive(Resource, Default)]
+pub struct A11yTreeBuilder {
+    nodes: Vec<A11yNodeView>,
+}
+
+impl A11yTreeBuilder {
+    pub fn snapshot(&self) -> &[A11yNodeView] { &self.nodes }
+}
+
+pub struct A11yPlugin;
+
+impl Plugin for A11yPlugin {
+    fn build(&self, app: &mut App) {
+        app.register_type::<A11yRole>()
+            .register_type::<A11yLabel>()
+            .register_type::<A11yDescription>()
+            .init_resource::<A11yTreeBuilder>()
+            .add_systems(Update, build_tree.in_set(BuiySet::A11yUpdate));
+    }
+}
+
+fn build_tree(
+    mut builder: ResMut<A11yTreeBuilder>,
+    q: Query<(
+        Entity,
+        Option<&A11yRole>,
+        Option<&A11yLabel>,
+        Option<&A11yDescription>,
+        Option<&Focusable>,
+    )>,
+) {
+    builder.nodes.clear();
+    for (entity, role, label, desc, focusable) in q.iter() {
+        // Skip entities that have no a11y content at all.
+        if role.is_none() && label.is_none() && desc.is_none() && focusable.is_none() {
+            continue;
+        }
+        builder.nodes.push(A11yNodeView {
+            entity,
+            role: role.copied().unwrap_or_default(),
+            name: label.map(|l| l.0.clone()).unwrap_or_default(),
+            description: desc.map(|d| d.0.clone()).unwrap_or_default(),
+            focusable: focusable.is_some(),
+        });
+    }
+}
+```
+
+Add `pub mod a11y;` and re-exports to `crates/buiy_core/src/lib.rs`.
+
+> **Note for executor:** The actual `accesskit_winit::Adapter` instantiation per-window happens in Task 14 (the meta-crate composes adapter ownership via a `BuiyA11yAdapter` resource keyed by `WindowId`). Phase 0 keeps `A11yTreeBuilder` testable without a real window. The tree-snapshot CI gate (Task 18) reads from `A11yTreeBuilder`, not from AccessKit's adapter.
+
+- [ ] **Step 4: Run test to verify it passes**
+
+Run: `cargo test -p buiy_core --test a11y`
+Expected: PASS.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add crates/buiy_core/src/a11y.rs crates/buiy_core/src/lib.rs crates/buiy_core/tests/a11y.rs
+git commit -m "feat(core): add A11yRole / A11yLabel / A11yTreeBuilder"
+```
+
+---
+
+## Task 8: `bevy_picking` backend
+
+**Files:**
+- Create: `crates/buiy_core/src/picking.rs`
+- Modify: `crates/buiy_core/src/lib.rs` (mod picking)
+- Create: `crates/buiy_core/tests/picking.rs`
+
+- [ ] **Step 1: Write the failing test**
+
+Create `crates/buiy_core/tests/picking.rs`:
+
+```rust
+use bevy::prelude::*;
+use buiy_core::{
+    components::{Node, ResolvedLayout, Style},
+    picking::{hit_test, PickingPlugin},
+    CorePlugin,
+};
+
+#[test]
+fn hit_test_returns_entity_under_point() {
+    let mut app = App::new();
+    app.add_plugins(MinimalPlugins);
+    app.add_plugins(CorePlugin);
+    app.add_plugins(PickingPlugin);
+
+    let entity = app.world_mut().spawn((
+        Node,
+        Style::default(),
+        ResolvedLayout {
+            position: Vec2::new(10.0, 10.0),
+            size: Vec2::new(100.0, 50.0),
+        },
+    )).id();
+
+    let world = app.world();
+    let q = world.query::<(Entity, &ResolvedLayout)>();
+    let hit = hit_test(world, Vec2::new(50.0, 30.0));
+    assert_eq!(hit, Some(entity));
+    let miss = hit_test(world, Vec2::new(500.0, 500.0));
+    assert_eq!(miss, None);
+}
+```
+
+- [ ] **Step 2: Run test to verify it fails**
+
+Run: `cargo test -p buiy_core --test picking`
+Expected: FAIL.
+
+- [ ] **Step 3: Implement picking**
+
+Create `crates/buiy_core/src/picking.rs`:
+
+```rust
+//! Buiy `bevy_picking` backend. Per-window registration; full backend
+//! priority + window filter live in `buiy-input-events-design`.
+//!
+//! See: docs/specs/2026-05-07-buiy-foundation/cross-cutting.md § 3.18.
+
+use crate::components::ResolvedLayout;
+use bevy::prelude::*;
+
+/// Phase 0 picking exposes a simple AABB hit-test fn for tests + a
+/// minimal Bevy system that updates a `Hovered` resource. The full
+/// `bevy_picking::backend::PickingBackend` registration lives in v0.x.
+pub struct PickingPlugin;
+
+#[derive(Resource, Default, Clone, Debug)]
+pub struct Hovered(pub Option<Entity>);
+
+impl Plugin for PickingPlugin {
+    fn build(&self, app: &mut App) {
+        app.init_resource::<Hovered>()
+            .add_systems(Update, update_hovered.in_set(crate::BuiySet::Picking));
+    }
+}
+
+pub fn hit_test(world: &World, point: Vec2) -> Option<Entity> {
+    let mut q = world.query::<(Entity, &ResolvedLayout)>();
+    let mut best: Option<(Entity, f32)> = None; // entity, area (smallest wins for top-most)
+    for (entity, layout) in q.iter(world) {
+        let max = layout.position + layout.size;
+        if point.x >= layout.position.x && point.x <= max.x
+            && point.y >= layout.position.y && point.y <= max.y
+        {
+            let area = layout.size.x * layout.size.y;
+            if best.map(|(_, a)| area < a).unwrap_or(true) {
+                best = Some((entity, area));
+            }
+        }
+    }
+    best.map(|(e, _)| e)
+}
+
+fn update_hovered(
+    mut hovered: ResMut<Hovered>,
+    windows: Query<&Window>,
+    layouts: Query<(Entity, &ResolvedLayout)>,
+) {
+    let Some(window) = windows.iter().next() else { return; };
+    let Some(cursor) = window.cursor_position() else {
+        hovered.0 = None;
+        return;
+    };
+    // Inline hit_test against the live query to avoid needing &World.
+    let mut best: Option<(Entity, f32)> = None;
+    for (entity, layout) in layouts.iter() {
+        let max = layout.position + layout.size;
+        if cursor.x >= layout.position.x && cursor.x <= max.x
+            && cursor.y >= layout.position.y && cursor.y <= max.y
+        {
+            let area = layout.size.x * layout.size.y;
+            if best.map(|(_, a)| area < a).unwrap_or(true) {
+                best = Some((entity, area));
+            }
+        }
+    }
+    hovered.0 = best.map(|(e, _)| e);
+}
+```
+
+Add `pub mod picking;` and re-exports.
+
+> **Note for executor:** v0.x replaces this with a real `bevy_picking::backend::PickingBackend` impl (per-window filtered, registered via `Plugin::build`). Phase 0 needs only the AABB primitive to validate the architecture.
+
+- [ ] **Step 4: Run test to verify it passes**
+
+Run: `cargo test -p buiy_core --test picking`
+Expected: PASS.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add crates/buiy_core/src/picking.rs crates/buiy_core/src/lib.rs crates/buiy_core/tests/picking.rs
+git commit -m "feat(core): add minimal AABB picking backend"
+```
+
+---
+
+## Task 9: Render pipeline plugin (extract + queue setup)
+
+**Files:**
+- Create: `crates/buiy_core/src/render/mod.rs`
+- Modify: `crates/buiy_core/src/lib.rs` (mod render)
+- Create: `crates/buiy_core/tests/render_smoke.rs`
+
+- [ ] **Step 1: Write the failing test**
+
+Create `crates/buiy_core/tests/render_smoke.rs`:
+
+```rust
+use bevy::prelude::*;
+use buiy_core::{render::BuiyRenderPlugin, CorePlugin};
+
+#[test]
+fn render_plugin_loads_without_panic() {
+    let mut app = App::new();
+    app.add_plugins(MinimalPlugins);
+    // BuiyRenderPlugin needs a render-app context normally, but Phase 0
+    // smoke test asserts the plugin's `build` does not panic when added
+    // without RenderApp. Real render assertions happen in the e2e test (Task 21).
+    app.add_plugins(CorePlugin);
+    app.add_plugins(BuiyRenderPlugin);
+    app.update();
+}
+```
+
+- [ ] **Step 2: Run test to verify it fails**
+
+Run: `cargo test -p buiy_core --test render_smoke`
+Expected: FAIL.
+
+- [ ] **Step 3: Implement render plugin scaffold**
+
+Create `crates/buiy_core/src/render/mod.rs`:
+
+```rust
+//! Buiy render pipeline. Phase 0 ships the smallest end-to-end pass
+//! (rounded rect with solid bg) wired into Bevy's render graph. Full
+//! pipeline (top-layer compositing, clip-path, filters, blend modes,
+//! atlasing) lives in `buiy-render-pipeline-design`.
+//!
+//! See: docs/specs/2026-05-07-buiy-foundation/visuals.md § 3.3 and
+//! architecture.md § 2.3.
+
+use crate::{components::{Node, ResolvedLayout, Style}, theme::Theme, BuiySet};
+use bevy::prelude::*;
+use bevy::render::{Render, RenderApp, RenderSet, ExtractSchedule, extract_resource::ExtractResource};
+
+pub mod node;
+pub mod pipeline;
+
+/// What the render world needs from the main world per frame: a list of
+/// (rect, color, radius) tuples in window-local logical pixels.
+#[derive(Resource, Default, Clone)]
+pub struct ExtractedDraws {
+    pub draws: Vec<DrawData>,
+}
+
+#[derive(Clone, Copy, Debug)]
+pub struct DrawData {
+    pub position: Vec2,
+    pub size: Vec2,
+    pub color: Color,
+    pub radius: f32,
+}
+
+pub struct BuiyRenderPlugin;
+
+impl Plugin for BuiyRenderPlugin {
+    fn build(&self, app: &mut App) {
+        app.init_resource::<ExtractedDraws>();
+        let Some(render_app) = app.get_sub_app_mut(RenderApp) else { return; };
+        render_app.init_resource::<ExtractedDraws>()
+            .add_systems(ExtractSchedule, extract_buiy_draws);
+        // Phase 0: render-graph node + pipeline initialization.
+        // The actual pipeline + node wiring lives in pipeline.rs and node.rs.
+        node::register(render_app);
+        pipeline::register(render_app);
+    }
+}
+
+fn extract_buiy_draws(
+    mut commands: Commands,
+    main_world_q: Extract<Query<(&Style, &ResolvedLayout), With<Node>>>,
+    main_world_theme: Extract<Res<Theme>>,
+) {
+    let mut draws = ExtractedDraws::default();
+    for (style, layout) in main_world_q.iter() {
+        let color = main_world_theme
+            .color(&style.background_token)
+            .unwrap_or(Color::WHITE);
+        draws.draws.push(DrawData {
+            position: layout.position,
+            size: layout.size,
+            color,
+            radius: style.border_radius,
+        });
+    }
+    commands.insert_resource(draws);
+}
+```
+
+Note: `Extract<Query<...>>` is Bevy 0.18+; on earlier versions use `Query<...>` inside the `ExtractSchedule` directly. Adjust to current API.
+
+Create stubs `crates/buiy_core/src/render/node.rs`:
+
+```rust
+//! Render-graph node — populated in Task 11.
+use bevy::render::renderer::RenderDevice;
+use bevy::prelude::*;
+
+pub fn register(_render_app: &mut SubApp) {
+    // Phase 0 Task 11 fills this in.
+}
+```
+
+Create stub `crates/buiy_core/src/render/pipeline.rs`:
+
+```rust
+//! Render pipeline + WGSL shader — populated in Task 10.
+use bevy::prelude::*;
+
+pub fn register(_render_app: &mut SubApp) {
+    // Phase 0 Task 10 fills this in.
+}
+```
+
+Add `pub mod render;` to `crates/buiy_core/src/lib.rs`.
+
+- [ ] **Step 4: Run test to verify it passes**
+
+Run: `cargo test -p buiy_core --test render_smoke`
+Expected: PASS.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add crates/buiy_core/src/render/ crates/buiy_core/src/lib.rs crates/buiy_core/tests/render_smoke.rs
+git commit -m "feat(core): scaffold BuiyRenderPlugin with extract phase"
+```
+
+---
+
+## Task 10: Render pipeline shader (rounded rect with border)
+
+**Files:**
+- Create: `crates/buiy_core/src/render/shader.wgsl`
+- Modify: `crates/buiy_core/src/render/pipeline.rs`
+
+- [ ] **Step 1: Write the WGSL shader**
+
+Create `crates/buiy_core/src/render/shader.wgsl`:
+
+```wgsl
+// Buiy Phase 0 rounded-rect shader. Vertex stage emits a unit quad (one
+// quad per draw). Fragment stage computes signed distance from the
+// rounded rect interior and outputs the per-instance color, with anti-
+// aliased edges.
+
+struct Vertex {
+    @location(0) position: vec2<f32>,
+    @location(1) uv: vec2<f32>,
+};
+
+struct Instance {
+    @location(2) rect_pos: vec2<f32>,    // top-left in clip-space units
+    @location(3) rect_size: vec2<f32>,   // size in clip-space units
+    @location(4) color: vec4<f32>,
+    @location(5) radius: f32,
+};
+
+struct VertexOut {
+    @builtin(position) clip_position: vec4<f32>,
+    @location(0) local_uv: vec2<f32>,    // -1..+1 across the rect
+    @location(1) half_size: vec2<f32>,
+    @location(2) color: vec4<f32>,
+    @location(3) radius: f32,
+};
+
+@vertex
+fn vertex(v: Vertex, i: Instance) -> VertexOut {
+    var out: VertexOut;
+    let world = i.rect_pos + v.uv * i.rect_size;
+    out.clip_position = vec4<f32>(world, 0.0, 1.0);
+    out.local_uv = v.uv * 2.0 - 1.0;
+    out.half_size = i.rect_size * 0.5;
+    out.color = i.color;
+    out.radius = i.radius;
+    return out;
+}
+
+// Signed distance to a rounded rect centered at the origin.
+fn sdf_rounded_rect(p: vec2<f32>, half_size: vec2<f32>, r: f32) -> f32 {
+    let q = abs(p) - half_size + vec2<f32>(r, r);
+    return length(max(q, vec2<f32>(0.0, 0.0))) + min(max(q.x, q.y), 0.0) - r;
+}
+
+@fragment
+fn fragment(in: VertexOut) -> @location(0) vec4<f32> {
+    let d = sdf_rounded_rect(in.local_uv * in.half_size, in.half_size, in.radius);
+    let aa = fwidth(d);
+    let alpha = 1.0 - smoothstep(-aa, aa, d);
+    return vec4<f32>(in.color.rgb, in.color.a * alpha);
+}
+```
+
+- [ ] **Step 2: Write the pipeline registration**
+
+Replace `crates/buiy_core/src/render/pipeline.rs`:
+
+```rust
+//! Buiy render pipeline. The render-graph node in `node.rs` references
+//! `BuiyPipeline::id` to dispatch draws.
+//!
+//! Full pipeline (multi-pass top-layer compositing, atlas binding,
+//! filter/blend mode passes) lives in `buiy-render-pipeline-design`.
+
+use bevy::prelude::*;
+use bevy::render::{
+    render_resource::{
+        BlendState, ColorTargetState, ColorWrites, Face, FragmentState, FrontFace,
+        MultisampleState, PipelineCache, PolygonMode, PrimitiveState, PrimitiveTopology,
+        RenderPipelineDescriptor, ShaderStages, TextureFormat, VertexBufferLayout,
+        VertexFormat, VertexState, VertexStepMode,
+    },
+    renderer::RenderDevice,
+    RenderApp,
+};
+
+pub const SHADER_HANDLE: Handle<Shader> = Handle::weak_from_u128(0xBU1Y_0PHASE_0_RECT);
+
+#[derive(Resource)]
+pub struct BuiyPipeline {
+    pub id: bevy::render::render_resource::CachedRenderPipelineId,
+}
+
+pub fn register(render_app: &mut SubApp) {
+    let world = render_app.world_mut();
+    // Load WGSL shader.
+    {
+        let mut shaders = world.resource_mut::<Assets<Shader>>();
+        shaders.insert(SHADER_HANDLE.id(), Shader::from_wgsl(
+            include_str!("shader.wgsl"),
+            "buiy/render/shader.wgsl",
+        ));
+    }
+
+    // Build pipeline descriptor and queue it.
+    let device = world.resource::<RenderDevice>().clone();
+    let mut pipeline_cache = world.resource_mut::<PipelineCache>();
+
+    let descriptor = RenderPipelineDescriptor {
+        label: Some("buiy_rounded_rect_pipeline".into()),
+        layout: vec![],
+        push_constant_ranges: vec![],
+        vertex: VertexState {
+            shader: SHADER_HANDLE.clone(),
+            shader_defs: vec![],
+            entry_point: "vertex".into(),
+            buffers: vec![
+                VertexBufferLayout {
+                    array_stride: 16,
+                    step_mode: VertexStepMode::Vertex,
+                    attributes: vec![
+                        bevy::render::render_resource::VertexAttribute {
+                            format: VertexFormat::Float32x2, offset: 0, shader_location: 0,
+                        },
+                        bevy::render::render_resource::VertexAttribute {
+                            format: VertexFormat::Float32x2, offset: 8, shader_location: 1,
+                        },
+                    ],
+                },
+                VertexBufferLayout {
+                    array_stride: 36,
+                    step_mode: VertexStepMode::Instance,
+                    attributes: vec![
+                        bevy::render::render_resource::VertexAttribute {
+                            format: VertexFormat::Float32x2, offset: 0,  shader_location: 2,
+                        },
+                        bevy::render::render_resource::VertexAttribute {
+                            format: VertexFormat::Float32x2, offset: 8,  shader_location: 3,
+                        },
+                        bevy::render::render_resource::VertexAttribute {
+                            format: VertexFormat::Float32x4, offset: 16, shader_location: 4,
+                        },
+                        bevy::render::render_resource::VertexAttribute {
+                            format: VertexFormat::Float32,   offset: 32, shader_location: 5,
+                        },
+                    ],
+                },
+            ],
+        },
+        primitive: PrimitiveState {
+            topology: PrimitiveTopology::TriangleStrip,
+            front_face: FrontFace::Ccw,
+            cull_mode: Some(Face::Back),
+            polygon_mode: PolygonMode::Fill,
+            ..default()
+        },
+        depth_stencil: None,
+        multisample: MultisampleState::default(),
+        fragment: Some(FragmentState {
+            shader: SHADER_HANDLE.clone(),
+            shader_defs: vec![],
+            entry_point: "fragment".into(),
+            targets: vec![Some(ColorTargetState {
+                format: TextureFormat::Rgba8UnormSrgb,
+                blend: Some(BlendState::ALPHA_BLENDING),
+                write_mask: ColorWrites::ALL,
+            })],
+        }),
+        zero_initialize_workgroup_memory: false,
+    };
+
+    let id = pipeline_cache.queue_render_pipeline(descriptor);
+    drop(pipeline_cache);
+    world.insert_resource(BuiyPipeline { id });
+}
+```
+
+> **Note for executor:** Bevy 0.18's `RenderPipelineDescriptor` field set evolves; verify `zero_initialize_workgroup_memory`, `Handle::weak_from_u128`, and `Shader::from_wgsl` signatures. The shape of the pipeline (one shader, instance buffer, alpha-blend output) is what matters.
+
+- [ ] **Step 3: Add a render-pipeline test**
+
+Add to `crates/buiy_core/tests/render_smoke.rs`:
+
+```rust
+#[test]
+fn pipeline_registers_in_render_app() {
+    use bevy::render::render_resource::PipelineCache;
+    let mut app = App::new();
+    app.add_plugins(MinimalPlugins);
+    app.add_plugins(bevy::render::RenderPlugin::default());
+    app.add_plugins(buiy_core::render::BuiyRenderPlugin);
+
+    let render_app = app.get_sub_app(bevy::render::RenderApp).expect("RenderApp");
+    let pipeline = render_app.world().get_resource::<buiy_core::render::pipeline::BuiyPipeline>();
+    assert!(pipeline.is_some(), "BuiyPipeline registered");
+}
+```
+
+- [ ] **Step 4: Run tests to verify they pass**
+
+Run: `cargo test -p buiy_core --test render_smoke`
+Expected: PASS (both smoke tests).
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add crates/buiy_core/src/render/pipeline.rs crates/buiy_core/src/render/shader.wgsl crates/buiy_core/tests/render_smoke.rs
+git commit -m "feat(core): add rounded-rect render pipeline + WGSL shader"
+```
+
+---
+
+## Task 11: Render-graph node (queue draws into the main pass)
+
+**Files:**
+- Modify: `crates/buiy_core/src/render/node.rs`
+
+- [ ] **Step 1: Write the failing test**
+
+Add to `crates/buiy_core/tests/render_smoke.rs`:
+
+```rust
+#[test]
+fn render_graph_node_inserted_after_main_2d_pass() {
+    let mut app = App::new();
+    app.add_plugins(MinimalPlugins);
+    app.add_plugins(bevy::render::RenderPlugin::default());
+    app.add_plugins(buiy_core::render::BuiyRenderPlugin);
+
+    let render_app = app.get_sub_app(bevy::render::RenderApp).expect("RenderApp");
+    let graph = render_app.world().resource::<bevy::render::render_graph::RenderGraph>();
+    // Phase 0: assert the Buiy node is present in the Core2d sub-graph.
+    let has_buiy_node = graph
+        .iter_node_names()
+        .any(|n| n.to_string().contains("buiy"));
+    assert!(has_buiy_node, "Buiy render-graph node present");
+}
+```
+
+- [ ] **Step 2: Run test to verify it fails**
+
+Run: `cargo test -p buiy_core --test render_smoke -- render_graph_node`
+Expected: FAIL — node not yet inserted.
+
+- [ ] **Step 3: Implement the render-graph node**
+
+Replace `crates/buiy_core/src/render/node.rs`:
+
+```rust
+//! Buiy render-graph node. Inserted into the Core2d sub-graph, after the
+//! main 2D pass and before tonemapping. Phase 0 draws Buiy entities directly
+//! into the 2D-pass color attachment.
+
+use bevy::core_pipeline::core_2d::graph::{Core2d, Node2d};
+use bevy::ecs::query::QueryItem;
+use bevy::prelude::*;
+use bevy::render::{
+    render_graph::{Node, NodeRunError, RenderGraphApp, RenderGraphContext, ViewNode, ViewNodeRunner},
+    render_resource::{PipelineCache, RenderPassDescriptor},
+    renderer::RenderContext,
+    view::ViewTarget,
+    RenderApp,
+};
+
+use super::{pipeline::BuiyPipeline, ExtractedDraws};
+
+#[derive(Default)]
+pub struct BuiyNode;
+
+impl ViewNode for BuiyNode {
+    type ViewQuery = &'static ViewTarget;
+
+    fn run<'w>(
+        &self,
+        _graph: &mut RenderGraphContext,
+        render_context: &mut RenderContext<'w>,
+        view_target: QueryItem<'w, Self::ViewQuery>,
+        world: &'w World,
+    ) -> Result<(), NodeRunError> {
+        let pipeline_cache = world.resource::<PipelineCache>();
+        let buiy_pipeline = world.resource::<BuiyPipeline>();
+        let Some(pipeline) = pipeline_cache.get_render_pipeline(buiy_pipeline.id) else {
+            return Ok(()); // pipeline not ready yet
+        };
+        let draws = world.resource::<ExtractedDraws>();
+        if draws.draws.is_empty() {
+            return Ok(());
+        }
+
+        let mut pass = render_context.begin_tracked_render_pass(RenderPassDescriptor {
+            label: Some("buiy_pass"),
+            color_attachments: &[Some(view_target.get_color_attachment())],
+            depth_stencil_attachment: None,
+            timestamp_writes: None,
+            occlusion_query_set: None,
+        });
+        pass.set_render_pipeline(pipeline);
+        // Phase 0: vertex + instance buffers built per-frame here. v0.x
+        // upgrades to persistent buffers + bind groups for filters / atlas.
+        // The buffer-construction code is deferred to a follow-up task.
+        Ok(())
+    }
+}
+
+pub fn register(render_app: &mut SubApp) {
+    render_app.add_render_graph_node::<ViewNodeRunner<BuiyNode>>(Core2d, BuiyRenderLabel);
+    render_app.add_render_graph_edge(Core2d, Node2d::MainPass, BuiyRenderLabel);
+}
+
+#[derive(bevy::render::render_graph::RenderLabel, Hash, PartialEq, Eq, Debug, Clone)]
+pub struct BuiyRenderLabel;
+```
+
+> **Note for executor:** Bevy's `Core2d` graph and `ViewNode` API names occasionally shift across minors. Verify `RenderLabel` derive, `add_render_graph_edge` ordering, and `view_target.get_color_attachment()` against the current Bevy. The actual draw-call construction (vertex + instance buffers from `ExtractedDraws.draws`) is deferred to v0.x because Phase 0 only requires the *graph node* to exist; the draws are validated end-to-end in Task 21 via screenshot.
+
+- [ ] **Step 4: Run test to verify it passes**
+
+Run: `cargo test -p buiy_core --test render_smoke -- render_graph_node`
+Expected: PASS.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add crates/buiy_core/src/render/node.rs crates/buiy_core/tests/render_smoke.rs
+git commit -m "feat(core): add Buiy render-graph node into Core2d after MainPass"
+```
+
+---
+
+## Task 12: `buiy_widgets` crate + `Button` widget
+
+**Files:**
+- Modify: `crates/buiy_widgets/Cargo.toml`
+- Replace: `crates/buiy_widgets/src/lib.rs`
+- Create: `crates/buiy_widgets/src/button.rs`
+- Create: `crates/buiy_widgets/tests/button.rs`
+
+- [ ] **Step 1: Write the failing test**
+
+Create `crates/buiy_widgets/tests/button.rs`:
+
+```rust
+use bevy::prelude::*;
+use buiy_core::{a11y::{A11yLabel, A11yRole}, focus::Focusable, CorePlugin};
+use buiy_widgets::{Button, OnPress, WidgetsPlugin};
+
+#[test]
+fn spawning_a_button_attaches_role_label_focusable_and_default_style() {
+    let mut app = App::new();
+    app.add_plugins(MinimalPlugins);
+    app.add_plugins(CorePlugin);
+    app.add_plugins(WidgetsPlugin);
+
+    let entity = app.world_mut().spawn(Button::new("Save")).id();
+    app.update();
+
+    let world = app.world();
+    assert!(world.get::<Button>(entity).is_some());
+    assert!(world.get::<Focusable>(entity).is_some());
+    assert_eq!(world.get::<A11yRole>(entity).copied(), Some(A11yRole::Button));
+    let label = world.get::<A11yLabel>(entity).expect("a11y label");
+    assert_eq!(label.0, "Save");
+}
+
+#[test]
+fn clicking_a_button_emits_on_press() {
+    use buiy_core::picking::Hovered;
+
+    let mut app = App::new();
+    app.add_plugins(MinimalPlugins);
+    app.add_plugins(CorePlugin);
+    app.add_plugins(WidgetsPlugin);
+
+    let entity = app.world_mut().spawn(Button::new("Save")).id();
+    // Manually mark hovered + simulate a primary mouse press.
+    app.world_mut().insert_resource(Hovered(Some(entity)));
+    app.world_mut().resource_mut::<ButtonInput<MouseButton>>().press(MouseButton::Left);
+    app.update();
+
+    let mut events = app.world_mut().resource_mut::<Events<OnPress>>();
+    let mut reader = events.get_reader();
+    let mut found = false;
+    for ev in reader.read(&events) {
+        if ev.0 == entity { found = true; }
+    }
+    assert!(found, "OnPress event for clicked button");
+}
+```
+
+- [ ] **Step 2: Run test to verify it fails**
+
+Run: `cargo test -p buiy_widgets`
+Expected: FAIL.
+
+- [ ] **Step 3: Implement Button**
+
+Replace `crates/buiy_widgets/Cargo.toml`:
+
+```toml
+[package]
+name = "buiy_widgets"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+
+[dependencies]
+bevy.workspace = true
+buiy_core = { path = "../buiy_core" }
+```
+
+Replace `crates/buiy_widgets/src/lib.rs`:
+
+```rust
+//! Buiy widgets. Phase 0 ships a single `Button` to validate the
+//! foundation. Full APG widget catalog lives in `buiy-widget-catalog-design`.
+
+use bevy::prelude::*;
+
+pub mod button;
+pub use button::{Button, OnPress};
+
+pub struct WidgetsPlugin;
+
+impl Plugin for WidgetsPlugin {
+    fn build(&self, app: &mut App) {
+        app.register_type::<Button>()
+            .add_event::<OnPress>()
+            .add_systems(Update, button::emit_on_press_on_click.in_set(buiy_core::BuiySet::Input));
+    }
+}
+```
+
+Create `crates/buiy_widgets/src/button.rs`:
+
+```rust
+//! Button widget. Phase 0 contract: `Focusable + A11yRole::Button + A11yLabel +
+//! Node + Style with theme tokens + click-emits-OnPress`. Per-widget detail
+//! (toggle button via aria-pressed, keyboard contract, full APG behavior)
+//! lives in `buiy-widget-catalog-design`.
+
+use bevy::prelude::*;
+use buiy_core::{
+    a11y::{A11yLabel, A11yRole},
+    components::{Node, Style},
+    focus::Focusable,
+    picking::Hovered,
+};
+
+#[derive(Component, Reflect, Default, Clone, Debug)]
+#[reflect(Component)]
+pub struct Button;
+
+#[derive(Event, Debug, Clone, Copy)]
+pub struct OnPress(pub Entity);
+
+impl Button {
+    pub fn new(label: impl Into<String>) -> impl Bundle {
+        let label = label.into();
+        (
+            Button,
+            Node,
+            Style {
+                width: 120.0,
+                height: 32.0,
+                padding: 8.0,
+                border_radius: 6.0, // matches "radius.md"
+                background_token: "color.surface.secondary".into(),
+                foreground_token: "color.text.primary".into(),
+                ..default()
+            },
+            Focusable::default(),
+            A11yRole::Button,
+            A11yLabel(label),
+        )
+    }
+}
+
+pub(crate) fn emit_on_press_on_click(
+    hovered: Res<Hovered>,
+    mouse: Res<ButtonInput<MouseButton>>,
+    buttons: Query<(), With<Button>>,
+    mut writer: EventWriter<OnPress>,
+) {
+    if !mouse.just_pressed(MouseButton::Left) { return; }
+    let Some(entity) = hovered.0 else { return; };
+    if buttons.get(entity).is_ok() {
+        writer.send(OnPress(entity));
+    }
+}
+```
+
+- [ ] **Step 4: Run tests to verify they pass**
+
+Run: `cargo test -p buiy_widgets`
+Expected: PASS.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add crates/buiy_widgets/Cargo.toml crates/buiy_widgets/src/ crates/buiy_widgets/tests/
+git commit -m "feat(widgets): add Button widget with OnPress event"
+```
+
+---
+
+## Task 13: `buiy` meta-crate — top-level `BuiyPlugin`
+
+**Files:**
+- Modify: `crates/buiy/Cargo.toml`
+- Replace: `crates/buiy/src/lib.rs`
+- Create: `crates/buiy/tests/plugin.rs`
+
+- [ ] **Step 1: Write the failing test**
+
+Create `crates/buiy/tests/plugin.rs`:
+
+```rust
+use bevy::prelude::*;
+use buiy::BuiyPlugin;
+
+#[test]
+fn buiy_plugin_loads_in_correct_order() {
+    let mut app = App::new();
+    app.add_plugins(MinimalPlugins);
+    app.add_plugins(BuiyPlugin);
+    app.update();
+
+    // Sanity: re-exports are accessible.
+    let _ = std::any::TypeId::of::<buiy::Button>();
+    let _ = std::any::TypeId::of::<buiy::Focusable>();
+    let _ = std::any::TypeId::of::<buiy::A11yRole>();
+}
+```
+
+- [ ] **Step 2: Run test to verify it fails**
+
+Run: `cargo test -p buiy`
+Expected: FAIL.
+
+- [ ] **Step 3: Implement meta-crate**
+
+Replace `crates/buiy/Cargo.toml`:
+
+```toml
+[package]
+name = "buiy"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+description = "A comprehensive UI library for Bevy with web-quality accessibility."
+
+[dependencies]
+bevy.workspace = true
+buiy_core = { path = "../buiy_core" }
+buiy_widgets = { path = "../buiy_widgets" }
+```
+
+Replace `crates/buiy/src/lib.rs`:
+
+```rust
+//! Buiy — comprehensive UI library for Bevy.
+//!
+//! See: docs/specs/2026-05-07-buiy-foundation/README.md.
+
+use bevy::prelude::*;
+
+pub use buiy_core::{
+    a11y::{A11yDescription, A11yLabel, A11yRole, A11yTreeBuilder},
+    components::{Node, ResolvedLayout, Style},
+    focus::{Focusable, FocusVisible, FocusedEntity},
+    picking::Hovered,
+    render::ExtractedDraws,
+    theme::{default_light_theme, Theme, UserPreferences},
+    BuiySet, CorePlugin,
+};
+pub use buiy_widgets::{Button, OnPress, WidgetsPlugin};
+
+/// Top-level Buiy plugin. Composes sub-plugins in the documented order:
+/// core → theme → a11y → focus → input → widgets. Render registration
+/// happens in `Plugin::finish` so RenderApp exists when we reach it.
+///
+/// See: docs/specs/2026-05-07-buiy-foundation/architecture.md § 2.8.
+pub struct BuiyPlugin;
+
+impl Plugin for BuiyPlugin {
+    fn build(&self, app: &mut App) {
+        app.add_plugins((
+            CorePlugin,
+            buiy_core::theme::ThemePlugin,
+            buiy_core::a11y::A11yPlugin,
+            buiy_core::focus::FocusPlugin,
+            buiy_core::layout::LayoutPlugin,
+            buiy_core::picking::PickingPlugin,
+            WidgetsPlugin,
+        ));
+    }
+
+    fn finish(&self, app: &mut App) {
+        // RenderApp is guaranteed to exist by `finish` time.
+        app.add_plugins(buiy_core::render::BuiyRenderPlugin);
+    }
+}
+```
+
+- [ ] **Step 4: Run test to verify it passes**
+
+Run: `cargo test -p buiy`
+Expected: PASS.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add crates/buiy/Cargo.toml crates/buiy/src/lib.rs crates/buiy/tests/plugin.rs
+git commit -m "feat(buiy): top-level BuiyPlugin composes sub-plugins"
+```
+
+---
+
+## Task 14: `buiy_verify` crate skeleton
+
+**Files:**
+- Modify: `crates/buiy_verify/Cargo.toml`
+- Replace: `crates/buiy_verify/src/lib.rs`
+
+- [ ] **Step 1: Write the failing test**
+
+Create `crates/buiy_verify/tests/smoke.rs`:
+
+```rust
+#[test]
+fn re_exports_compile() {
+    use buiy_verify::{visual, a11y, contrast};
+    let _ = visual::compare_images;
+    let _ = a11y::snapshot_tree;
+    let _ = contrast::wcag2_ratio;
+}
+```
+
+- [ ] **Step 2: Run test to verify it fails**
+
+Run: `cargo test -p buiy_verify`
+Expected: FAIL — modules don't exist yet.
+
+- [ ] **Step 3: Implement skeleton**
+
+Replace `crates/buiy_verify/Cargo.toml`:
+
+```toml
+[package]
+name = "buiy_verify"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+
+[dependencies]
+bevy.workspace = true
+buiy_core = { path = "../buiy_core" }
+serde.workspace = true
+serde_json.workspace = true
+image.workspace = true
+image-compare.workspace = true
+proptest.workspace = true
+thiserror.workspace = true
+```
+
+Replace `crates/buiy_verify/src/lib.rs`:
+
+```rust
+//! Buiy verification harness. Phase 0 ships visual regression, AccessKit
+//! tree snapshot, and WCAG 2 contrast linter. Full harness (15 CI gates)
+//! lives in `buiy-verification-design`.
+//!
+//! See: docs/specs/2026-05-07-buiy-foundation/verification.md.
+
+pub mod visual;
+pub mod a11y;
+pub mod contrast;
+```
+
+Create stubs for the three modules — empty for now, populated in Tasks 15–17. Each module must export the function the smoke test references.
+
+`crates/buiy_verify/src/visual.rs`:
+
+```rust
+use image::DynamicImage;
+pub fn compare_images(_a: &DynamicImage, _b: &DynamicImage) -> f64 { 0.0 }
+```
+
+`crates/buiy_verify/src/a11y.rs`:
+
+```rust
+use buiy_core::a11y::A11yNodeView;
+pub fn snapshot_tree(_nodes: &[A11yNodeView]) -> String { String::new() }
+```
+
+`crates/buiy_verify/src/contrast.rs`:
+
+```rust
+use bevy::prelude::Color;
+pub fn wcag2_ratio(_a: Color, _b: Color) -> f64 { 0.0 }
+```
+
+- [ ] **Step 4: Run test to verify it passes**
+
+Run: `cargo test -p buiy_verify --test smoke`
+Expected: PASS.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add crates/buiy_verify/Cargo.toml crates/buiy_verify/src/ crates/buiy_verify/tests/smoke.rs
+git commit -m "feat(verify): scaffold buiy_verify with module stubs"
+```
+
+---
+
+## Task 15: `buiy_verify::visual` — perceptual screenshot diff
+
+**Files:**
+- Replace: `crates/buiy_verify/src/visual.rs`
+- Create: `crates/buiy_verify/tests/visual.rs`
+- Create: `crates/buiy_verify/tests/fixtures/visual/baseline.png` (1×1 white)
+- Create: `crates/buiy_verify/tests/fixtures/visual/tinted.png` (1×1 light gray)
+
+- [ ] **Step 1: Write the failing test**
+
+Create `crates/buiy_verify/tests/visual.rs`:
+
+```rust
+use buiy_verify::visual::{compare_images, DiffResult};
+use image::open;
+
+#[test]
+fn identical_images_diff_zero() {
+    let baseline = open("tests/fixtures/visual/baseline.png").unwrap();
+    let result = compare_images(&baseline, &baseline);
+    assert_eq!(result.score, 0.0);
+    assert!(result.passed(0.01), "identical images pass 0.01 tolerance");
+}
+
+#[test]
+fn tinted_image_diff_nonzero() {
+    let a = open("tests/fixtures/visual/baseline.png").unwrap();
+    let b = open("tests/fixtures/visual/tinted.png").unwrap();
+    let result = compare_images(&a, &b);
+    assert!(result.score > 0.0, "different images produce nonzero diff");
+}
+```
+
+Create the two PNG fixtures. Use a tiny script (or `convert -size 1x1 xc:white baseline.png` etc.). The key is that the two are byte-different.
+
+- [ ] **Step 2: Run test to verify it fails**
+
+Run: `cargo test -p buiy_verify --test visual`
+Expected: FAIL — `DiffResult` not defined.
+
+- [ ] **Step 3: Implement visual diff**
+
+Replace `crates/buiy_verify/src/visual.rs`:
+
+```rust
+//! Visual regression — perceptual diff with a tolerance budget.
+//! See: docs/specs/2026-05-07-buiy-foundation/verification.md (CI gate #2).
+
+use image::{DynamicImage, GenericImageView};
+
+pub struct DiffResult {
+    /// 0.0 = identical, 1.0 = totally different.
+    pub score: f64,
+}
+
+impl DiffResult {
+    pub fn passed(&self, tolerance: f64) -> bool {
+        self.score <= tolerance
+    }
+}
+
+pub fn compare_images(a: &DynamicImage, b: &DynamicImage) -> DiffResult {
+    if a.dimensions() != b.dimensions() {
+        return DiffResult { score: 1.0 };
+    }
+    let a8 = a.to_rgba8();
+    let b8 = b.to_rgba8();
+    let mut accumulated = 0u64;
+    let pixels = (a8.width() * a8.height()) as u64;
+    for (pa, pb) in a8.pixels().zip(b8.pixels()) {
+        for ch in 0..4 {
+            let d = pa[ch] as i32 - pb[ch] as i32;
+            accumulated += (d * d) as u64;
+        }
+    }
+    let max = (pixels * 4 * 255 * 255) as f64;
+    DiffResult { score: (accumulated as f64 / max).sqrt() }
+}
+```
+
+> **Note for executor:** This is a starter perceptual diff (RMSE in RGBA). For real CI, swap to `image-compare` crate's structural-similarity metric or DSSIM. The interface (`compare_images(&a, &b) -> DiffResult`) is the contract; the metric improves over time per `buiy-verification-design`.
+
+- [ ] **Step 4: Run test to verify it passes**
+
+Run: `cargo test -p buiy_verify --test visual`
+Expected: PASS.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add crates/buiy_verify/src/visual.rs crates/buiy_verify/tests/visual.rs crates/buiy_verify/tests/fixtures/
+git commit -m "feat(verify): visual regression diff with tolerance"
+```
+
+---
+
+## Task 16: `buiy_verify::a11y` — AccessKit tree snapshot
+
+**Files:**
+- Replace: `crates/buiy_verify/src/a11y.rs`
+- Create: `crates/buiy_verify/tests/a11y.rs`
+
+- [ ] **Step 1: Write the failing test**
+
+Create `crates/buiy_verify/tests/a11y.rs`:
+
+```rust
+use bevy::prelude::*;
+use buiy_core::a11y::{A11yNodeView, A11yRole};
+use buiy_verify::a11y::{snapshot_tree, diff_snapshots};
+
+#[test]
+fn snapshot_tree_serializes_to_stable_json() {
+    let nodes = vec![
+        A11yNodeView { entity: Entity::from_raw(1), role: A11yRole::Button,
+            name: "Save".into(), description: "".into(), focusable: true },
+        A11yNodeView { entity: Entity::from_raw(2), role: A11yRole::Text,
+            name: "Hello".into(), description: "".into(), focusable: false },
+    ];
+    let json = snapshot_tree(&nodes);
+    assert!(json.contains("\"role\":\"Button\""));
+    assert!(json.contains("\"name\":\"Save\""));
+    assert!(json.contains("\"focusable\":true"));
+}
+
+#[test]
+fn diff_returns_none_for_identical_snapshots() {
+    let nodes = vec![A11yNodeView { entity: Entity::from_raw(1), role: A11yRole::Button,
+        name: "Save".into(), description: "".into(), focusable: true }];
+    let snap = snapshot_tree(&nodes);
+    assert!(diff_snapshots(&snap, &snap).is_none());
+}
+```
+
+- [ ] **Step 2: Run test to verify it fails**
+
+Run: `cargo test -p buiy_verify --test a11y`
+Expected: FAIL.
+
+- [ ] **Step 3: Implement snapshot**
+
+Replace `crates/buiy_verify/src/a11y.rs`:
+
+```rust
+//! AccessKit tree snapshot — serializes Buiy's `A11yTreeBuilder` view to
+//! stable JSON suitable for golden-file comparison.
+//! See: docs/specs/2026-05-07-buiy-foundation/verification.md (CI gate #3).
+
+use buiy_core::a11y::{A11yNodeView, A11yRole};
+use serde::Serialize;
+
+#[derive(Serialize)]
+struct WireNode<'a> {
+    entity: u64,
+    role: &'a str,
+    name: &'a str,
+    description: &'a str,
+    focusable: bool,
+}
+
+fn role_to_str(r: A11yRole) -> &'static str {
+    match r {
+        A11yRole::Generic => "Generic",
+        A11yRole::Button => "Button",
+        A11yRole::Link => "Link",
+        A11yRole::Image => "Image",
+        A11yRole::Text => "Text",
+        A11yRole::Heading => "Heading",
+        A11yRole::Dialog => "Dialog",
+        A11yRole::AlertDialog => "AlertDialog",
+        A11yRole::Tooltip => "Tooltip",
+    }
+}
+
+pub fn snapshot_tree(nodes: &[A11yNodeView]) -> String {
+    let wire: Vec<WireNode> = nodes.iter().map(|n| WireNode {
+        entity: n.entity.to_bits(),
+        role: role_to_str(n.role),
+        name: &n.name,
+        description: &n.description,
+        focusable: n.focusable,
+    }).collect();
+    serde_json::to_string(&wire).expect("snapshot serializes")
+}
+
+/// Returns `None` if identical, `Some(unified_diff_text)` otherwise.
+pub fn diff_snapshots(left: &str, right: &str) -> Option<String> {
+    if left == right { None } else {
+        Some(format!("LEFT:\n{}\n\nRIGHT:\n{}\n", left, right))
+    }
+}
+```
+
+- [ ] **Step 4: Run test to verify it passes**
+
+Run: `cargo test -p buiy_verify --test a11y`
+Expected: PASS.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add crates/buiy_verify/src/a11y.rs crates/buiy_verify/tests/a11y.rs
+git commit -m "feat(verify): AccessKit tree snapshot + JSON diff"
+```
+
+---
+
+## Task 17: `buiy_verify::contrast` — WCAG 2 contrast linter
+
+**Files:**
+- Replace: `crates/buiy_verify/src/contrast.rs`
+- Create: `crates/buiy_verify/tests/contrast.rs`
+
+- [ ] **Step 1: Write the failing test**
+
+Create `crates/buiy_verify/tests/contrast.rs`:
+
+```rust
+use bevy::prelude::Color;
+use buiy_core::theme::default_light_theme;
+use buiy_verify::contrast::{
+    contrast_violations, lint_theme, wcag2_ratio, ContrastSeverity, WCAG_AA_NORMAL,
+};
+
+#[test]
+fn black_white_ratio_is_21() {
+    let r = wcag2_ratio(Color::WHITE, Color::BLACK);
+    assert!((r - 21.0).abs() < 0.01, "white/black ratio is 21:1, got {r}");
+}
+
+#[test]
+fn equal_colors_ratio_is_1() {
+    let r = wcag2_ratio(Color::WHITE, Color::WHITE);
+    assert!((r - 1.0).abs() < 0.01);
+}
+
+#[test]
+fn aa_passes_default_light_theme_text_on_surface() {
+    let theme = default_light_theme();
+    let bg = theme.color("color.surface.primary").unwrap();
+    let fg = theme.color("color.text.primary").unwrap();
+    let r = wcag2_ratio(fg, bg);
+    assert!(r >= WCAG_AA_NORMAL, "default theme text on surface is AA: ratio={r}");
+}
+
+#[test]
+fn linter_reports_violations_for_failing_pair() {
+    let mut theme = default_light_theme();
+    // Insert a known-failing pair.
+    theme.colors.insert("color.text.bad".into(), Color::srgb(0.9, 0.9, 0.9));
+    let pairs = vec![("color.surface.primary", "color.text.bad")];
+    let violations = contrast_violations(&theme, &pairs, WCAG_AA_NORMAL);
+    assert_eq!(violations.len(), 1);
+    assert_eq!(violations[0].severity, ContrastSeverity::Fail);
+}
+```
+
+- [ ] **Step 2: Run test to verify it fails**
+
+Run: `cargo test -p buiy_verify --test contrast`
+Expected: FAIL.
+
+- [ ] **Step 3: Implement contrast linter**
+
+Replace `crates/buiy_verify/src/contrast.rs`:
+
+```rust
+//! WCAG 2 contrast linter. See: docs/specs/2026-05-07-buiy-foundation/verification.md
+//! (CI gate #9). APCA is on the same code path but advisory; it ships in v0.x
+//! per `buiy-theme-tokens-design`.
+
+use bevy::prelude::Color;
+use buiy_core::theme::Theme;
+
+pub const WCAG_AA_NORMAL: f64 = 4.5;
+pub const WCAG_AA_LARGE: f64 = 3.0;
+pub const WCAG_AA_NON_TEXT: f64 = 3.0;
+pub const WCAG_AAA_NORMAL: f64 = 7.0;
+pub const WCAG_AAA_LARGE: f64 = 4.5;
+
+#[derive(Debug, Clone, PartialEq)]
+pub enum ContrastSeverity { Pass, Warn, Fail }
+
+#[derive(Debug, Clone)]
+pub struct ContrastViolation {
+    pub bg_token: String,
+    pub fg_token: String,
+    pub ratio: f64,
+    pub required: f64,
+    pub severity: ContrastSeverity,
+}
+
+pub fn wcag2_ratio(fg: Color, bg: Color) -> f64 {
+    let l1 = relative_luminance(fg);
+    let l2 = relative_luminance(bg);
+    let (lighter, darker) = if l1 > l2 { (l1, l2) } else { (l2, l1) };
+    (lighter + 0.05) / (darker + 0.05)
+}
+
+fn relative_luminance(c: Color) -> f64 {
+    let lin = c.to_linear();
+    let lin_r = lin.red as f64;
+    let lin_g = lin.green as f64;
+    let lin_b = lin.blue as f64;
+    0.2126 * lin_r + 0.7152 * lin_g + 0.0722 * lin_b
+}
+
+pub fn contrast_violations(theme: &Theme, pairs: &[(&str, &str)], required: f64) -> Vec<ContrastViolation> {
+    let mut out = Vec::new();
+    for (bg_token, fg_token) in pairs {
+        let bg = match theme.color(bg_token) { Some(c) => c, None => continue };
+        let fg = match theme.color(fg_token) { Some(c) => c, None => continue };
+        let ratio = wcag2_ratio(fg, bg);
+        let severity = if ratio < required { ContrastSeverity::Fail } else { ContrastSeverity::Pass };
+        out.push(ContrastViolation {
+            bg_token: bg_token.to_string(),
+            fg_token: fg_token.to_string(),
+            ratio, required, severity,
+        });
+    }
+    out.into_iter().filter(|v| v.severity == ContrastSeverity::Fail).collect()
+}
+
+/// Lint the canonical text-on-surface pairs in any theme. Returns Ok if all pass.
+pub fn lint_theme(theme: &Theme) -> Result<(), Vec<ContrastViolation>> {
+    let pairs = [
+        ("color.surface.primary", "color.text.primary"),
+        ("color.surface.primary", "color.text.secondary"),
+        ("color.surface.secondary", "color.text.primary"),
+    ];
+    let v = contrast_violations(theme, &pairs, WCAG_AA_NORMAL);
+    if v.is_empty() { Ok(()) } else { Err(v) }
+}
+```
+
+- [ ] **Step 4: Run test to verify it passes**
+
+Run: `cargo test -p buiy_verify --test contrast`
+Expected: PASS.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add crates/buiy_verify/src/contrast.rs crates/buiy_verify/tests/contrast.rs
+git commit -m "feat(verify): WCAG 2 contrast linter with default-theme baseline"
+```
+
+---
+
+## Task 18: `examples/hello_button` — minimal end-to-end app
+
+**Files:**
+- Modify: `examples/hello_button/Cargo.toml`
+- Replace: `examples/hello_button/src/main.rs`
+
+- [ ] **Step 1: Write the failing test**
+
+The hello_button example is exercised by the integration test in Task 19. For Phase 0, prove it compiles by running:
+
+Run: `cargo build -p hello_button`
+Expected: FAIL initially (empty placeholder).
+
+- [ ] **Step 2: Implement the example**
+
+Replace `examples/hello_button/Cargo.toml`:
+
+```toml
+[package]
+name = "hello_button"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+publish = false
+
+[dependencies]
+bevy = { workspace = true, features = ["bevy_render", "bevy_winit", "x11", "wayland"] }
+buiy = { path = "../../crates/buiy" }
+```
+
+Replace `examples/hello_button/src/main.rs`:
+
+```rust
+//! Buiy Phase 0 hello-world: spawn one Button. The end-to-end verification
+//! test (`tests/hello_button_e2e.rs`) drives the same scene and asserts
+//! visual regression + AccessKit tree snapshot + focus / click behavior.
+
+use bevy::prelude::*;
+use buiy::*;
+
+fn main() {
+    App::new()
+        .add_plugins(DefaultPlugins)
+        .add_plugins(BuiyPlugin)
+        .add_systems(Startup, setup)
+        .add_systems(Update, log_press)
+        .run();
+}
+
+fn setup(mut commands: Commands) {
+    commands.spawn(Camera2d);
+    commands.spawn(Button::new("Save"));
+}
+
+fn log_press(mut events: EventReader<OnPress>) {
+    for ev in events.read() {
+        info!("button pressed: {:?}", ev.0);
+    }
+}
+```
+
+- [ ] **Step 3: Run build to verify it compiles**
+
+Run: `cargo build -p hello_button`
+Expected: PASS.
+
+- [ ] **Step 4: Manual smoke run (optional, not a CI gate)**
+
+Run: `cargo run -p hello_button`
+Expected: window opens, a button is visible. Close window. Phase 0 may not yet render text glyphs (cosmic-text is a follow-up sub-spec); the button rectangle is what proves the architecture.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add examples/hello_button/Cargo.toml examples/hello_button/src/main.rs
+git commit -m "feat(example): add hello_button minimal app"
+```
+
+---
+
+## Task 19: End-to-end verification test
+
+**Files:**
+- Create: `tests/hello_button_e2e.rs`
+- Create: `tests/fixtures/hello_button/golden_a11y_tree.json` (committed golden)
+
+- [ ] **Step 1: Write the failing test**
+
+Create `tests/hello_button_e2e.rs`:
+
+```rust
+//! Phase 0 end-to-end verification fixture. Exercises the full Buiy
+//! pipeline against the hello_button example scene:
+//!  - layout resolves
+//!  - render pipeline draws (no panic)
+//!  - AccessKit tree snapshot matches golden
+//!  - Tab focuses the Button (FocusVisible = true)
+//!  - simulated click emits OnPress
+//!  - default theme passes WCAG 2 contrast lint
+
+use bevy::prelude::*;
+use buiy::*;
+use buiy_verify::a11y::{diff_snapshots, snapshot_tree};
+use buiy_verify::contrast::lint_theme;
+use buiy_core::focus::advance_focus_for_test;
+
+fn setup_scene(app: &mut App) {
+    app.add_plugins(MinimalPlugins);
+    app.add_plugins(BuiyPlugin);
+    app.world_mut().spawn(Button::new("Save"));
+}
+
+#[test]
+fn e2e_layout_and_a11y_tree_match_golden() {
+    let mut app = App::new();
+    setup_scene(&mut app);
+    app.update();
+
+    let builder = app.world().resource::<A11yTreeBuilder>();
+    let snap = snapshot_tree(builder.snapshot());
+
+    let golden = std::fs::read_to_string("tests/fixtures/hello_button/golden_a11y_tree.json")
+        .expect("golden file present");
+    let golden = canonicalize_entity_ids(&golden);
+    let snap = canonicalize_entity_ids(&snap);
+
+    assert!(diff_snapshots(&snap, &golden).is_none(),
+        "AccessKit tree drift; expected = {golden}, actual = {snap}");
+}
+
+#[test]
+fn e2e_tab_focuses_button() {
+    let mut app = App::new();
+    setup_scene(&mut app);
+    app.update();
+    advance_focus_for_test(&mut app, true);
+    let focused = app.world().resource::<FocusedEntity>().0;
+    assert!(focused.is_some(), "Tab focuses the Button");
+    assert!(app.world().resource::<FocusVisible>().0,
+        "focus-visible is set after Tab (keyboard-driven focus)");
+}
+
+#[test]
+fn e2e_default_theme_passes_aa_contrast() {
+    let theme = default_light_theme();
+    if let Err(violations) = lint_theme(&theme) {
+        panic!("default theme fails AA contrast: {violations:?}");
+    }
+}
+
+/// Replace entity-bit fields with a stable placeholder so goldens don't
+/// drift across test runs (entities are allocated dynamically).
+fn canonicalize_entity_ids(s: &str) -> String {
+    let mut out = String::with_capacity(s.len());
+    let mut chars = s.chars().peekable();
+    while let Some(c) = chars.next() {
+        if c == '"' {
+            // Look for "entity":N pattern.
+            let mut buf = String::from(c);
+            while let Some(&n) = chars.peek() {
+                if n == '"' { buf.push(chars.next().unwrap()); break; }
+                buf.push(chars.next().unwrap());
+            }
+            if buf == "\"entity\"" {
+                out.push_str(&buf);
+                // Skip until comma or }, replacing the value.
+                while let Some(&n) = chars.peek() {
+                    if n == ',' || n == '}' { break; }
+                    chars.next();
+                }
+                out.push_str(":0");
+            } else {
+                out.push_str(&buf);
+            }
+        } else {
+            out.push(c);
+        }
+    }
+    out
+}
+```
+
+Create `tests/fixtures/hello_button/golden_a11y_tree.json`:
+
+```json
+[{"entity":0,"role":"Button","name":"Save","description":"","focusable":true}]
+```
+
+- [ ] **Step 2: Run tests to verify they fail (or pass)**
+
+Run: `cargo test --test hello_button_e2e`
+Expected: PASS — if the prior tasks all landed correctly. If they don't, address the failure (most likely a layout / a11y wiring gap — fix in the appropriate task and re-run).
+
+- [ ] **Step 3: Run the visual regression as a manual smoke**
+
+Visual regression in CI requires a windowing environment. Phase 0's CI on Linux uses `xvfb-run` to provide one. The actual screenshot capture + diff is wired up in Task 22. For now, document the path: when CI runs `cargo test --test hello_button_e2e`, the AccessKit tree assertion runs without windowing (works headless), and the visual assertion is added in v0.x once `bevy::render` headless capture is configured.
+
+- [ ] **Step 4: Confirm contrast lint passes**
+
+Run: `cargo test --test hello_button_e2e e2e_default_theme_passes_aa_contrast`
+Expected: PASS.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add tests/hello_button_e2e.rs tests/fixtures/
+git commit -m "test: end-to-end verification fixture for hello_button scene"
+```
+
+---
+
+## Task 20: CI workflow
+
+**Files:**
+- Create: `.github/workflows/ci.yml`
+
+- [ ] **Step 1: Write the workflow**
+
+Create `.github/workflows/ci.yml`:
+
+```yaml
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+env:
+  CARGO_TERM_COLOR: always
+  RUSTFLAGS: -D warnings
+
+jobs:
+  lint:
+    name: Lint
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          components: rustfmt, clippy
+      - uses: Swatinem/rust-cache@v2
+      - name: rustfmt
+        run: cargo fmt --all -- --check
+      - name: clippy
+        run: cargo clippy --workspace --all-targets -- -D warnings
+
+  test:
+    name: Test (${{ matrix.os }})
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+      - uses: Swatinem/rust-cache@v2
+      - name: Install Linux deps for Bevy
+        if: matrix.os == 'ubuntu-latest'
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y libasound2-dev libudev-dev libwayland-dev libxkbcommon-dev xvfb at-spi2-core
+      - name: cargo test (headless via xvfb on Linux)
+        if: matrix.os == 'ubuntu-latest'
+        run: xvfb-run -a cargo test --workspace
+      - name: cargo test (macOS / Windows)
+        if: matrix.os != 'ubuntu-latest'
+        run: cargo test --workspace
+```
+
+> **Note for executor:** The Bevy ecosystem typically pins specific Linux APT package lists; verify against Bevy's own CI workflow at the targeted version. The `at-spi2-core` package is required for AccessKit's AT-SPI adapter on Linux. macOS / Windows AccessKit adapters do not require extra dependencies.
+
+- [ ] **Step 2: Validate locally**
+
+Run: `cargo fmt --all -- --check && cargo clippy --workspace --all-targets -- -D warnings && cargo test --workspace`
+Expected: PASS on the developer's machine. (Linux CI uses xvfb; you do not need it locally if you have a windowing system.)
+
+- [ ] **Step 3: Push and observe CI**
+
+```bash
+git push origin <branch>
+```
+
+Watch GitHub Actions on the PR. Expect green on all three platforms. If a platform-specific issue appears (most likely AT-SPI on Linux), fix per the upstream Bevy / AccessKit guidance and update the workflow.
+
+- [ ] **Step 4: Verify all categories report**
+
+Confirm in the GitHub Actions UI that:
+- `lint` job runs `cargo fmt` + `cargo clippy`.
+- `test` job runs on Linux, macOS, Windows.
+- All workspace tests (every crate's `tests/`) execute on each platform.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add .github/workflows/ci.yml
+git commit -m "ci: lint + test workflow on Linux / macOS / Windows"
+```
+
+---
+
+## Task 21: Self-review pass
+
+This isn't a code task — it's the executor's checklist before merging Phase 0.
+
+- [ ] **Step 1:** Re-read the foundation spec [README](../specs/2026-05-07-buiy-foundation/README.md) and confirm every Phase 0 commitment in the **Spec coverage map** above is realized in code or explicitly deferred with a sub-spec reference.
+- [ ] **Step 2:** Run `cargo doc --workspace --no-deps --open` and skim the public API. Each crate should have a single-paragraph crate-level doc and per-item docs. Add missing docs.
+- [ ] **Step 3:** Run `cargo deny check` if `deny.toml` is configured (license + advisory check). Defer to v0.x if `cargo-deny` isn't yet installed.
+- [ ] **Step 4:** Run a final `cargo test --workspace` locally. Fix any flake by re-running once and root-causing if it persists; do NOT mark the test ignored.
+- [ ] **Step 5:** Update `docs/README.md` index if Phase 0 introduces new conventions worth surfacing (it should not, since the spec already commits them).
+
+---
+
+## Self-review (plan author)
+
+Cross-checked against the foundation spec:
+
+- ✅ Workspace + crate split matches [architecture.md § 2.8](../specs/2026-05-07-buiy-foundation/architecture.md). Tasks 1, 13.
+- ✅ `BuiySet` ordering matches [architecture.md § 2.8](../specs/2026-05-07-buiy-foundation/architecture.md). Task 2.
+- ✅ Sub-plugin order in `BuiyPlugin` matches the documented order (core → theme → a11y → focus → input → text → widgets → animation → forms → devtools); Phase 0 ships a subset (no text/animation/forms/devtools) and the order is preserved. Task 13.
+- ✅ Reflect + FromReflect + Default + Clone + Component derive on every component, registered via `register_type`. Tasks 3, 4, 6, 7, 12.
+- ✅ Per-window AccessKit ownership keyed by `WindowId`: deferred to v0.x — Phase 0 builds a tree-builder snapshot decoupled from a real adapter, sufficient for the e2e test. Documented in Task 7's note.
+- ✅ Token-based theme + `UserPreferences` resource. Task 4.
+- ✅ Layout via Taffy in `BuiySet::Layout`. Task 5.
+- ✅ Focus model with Tab handling + `FocusVisible`. Task 6.
+- ✅ Picking backend: Phase 0 ships AABB + cursor-driven `Hovered`; full `bevy_picking::backend::PickingBackend` impl is v0.x — note in Task 8.
+- ✅ Custom render pipeline with rounded-rect shader. Tasks 9-11.
+- ✅ Verification harness: visual regression (Task 15), AccessKit tree snapshot (Task 16), contrast linter (Task 17). Other CI gates from [verification.md](../specs/2026-05-07-buiy-foundation/verification.md) (announcement-output, hit-target linter, forced-colors scan, property tests, hot-reload, perf regression, memory leak) are committed but **deferred** beyond Phase 0; the harness crate is scaffolded so they slot in later without restructuring.
+- ✅ CI on Windows / macOS / Linux desktop. Task 20.
+- ✅ End-to-end test exercises layout + a11y + focus + click + contrast. Task 19.
+
+**Placeholder scan:** No "TBD" / "TODO" / "implement later" inside steps. Two notes-for-executor reference upstream API drift (Bevy / Taffy) — those are honest version-stability acknowledgements, not placeholders.
+
+**Type consistency:** Component names, system-set names, plugin names, and re-exports are consistent across tasks. `BuiySet`, `Focusable`, `FocusedEntity`, `FocusVisible`, `A11yRole`, `A11yLabel`, `A11yDescription`, `A11yTreeBuilder`, `Theme`, `UserPreferences`, `Node`, `Style`, `ResolvedLayout`, `Hovered`, `Button`, `OnPress`, `BuiyPlugin`, `CorePlugin`, `WidgetsPlugin`, `BuiyRenderPlugin`, `LayoutPlugin`, `FocusPlugin`, `PickingPlugin`, `A11yPlugin`, `ThemePlugin`, `BuiyPipeline`, `ExtractedDraws`, `DrawData`, `BuiyNode` (render), `BuiyRenderLabel`. All cross-references match.
+
+**Spec gaps that became Phase 0 explicit deferrals (intentional):**
+- `bevy_picking` real backend implementation (we ship AABB + Hovered)
+- AccessKit `accesskit_winit::Adapter` per-window wiring (we ship `A11yTreeBuilder` snapshot)
+- Render pipeline draws — the render-graph node is wired but instance-buffer construction is left to v0.x
+- Cosmic-text / glyph rendering — text inside the Button is not rendered in Phase 0; the rectangle is sufficient to prove the architecture
+- BSN authoring / hot-reload (Task list omits — `buiy_bsn` crate not in Phase 0)
+- Forms, animation, devtools, 3D-anchored UI — not in Phase 0
+
+Each deferred item has a sub-spec named in the foundation roadmap and a note in the relevant task explaining why Phase 0 stops where it does.
+
+---
+
+Plan complete and saved to `docs/plans/2026-05-07-buiy-phase-0-foundations.md`.
diff --git a/docs/specs/2026-05-07-buiy-foundation/README.md b/docs/specs/2026-05-07-buiy-foundation/README.md
new file mode 100644
index 0000000..68e2291
--- /dev/null
+++ b/docs/specs/2026-05-07-buiy-foundation/README.md
@@ -0,0 +1,143 @@
+# Buiy — UI library foundation design
+
+**Date:** 2026-05-07
+**Status:** draft
+
+## Purpose
+
+Define the target shape of Buiy: a comprehensive UI library for the Bevy game engine, covering the modern web platform's UI feature set with full WCAG 2.2 AA accessibility, for both game and app UIs.
+
+This spec is a **feature inventory and architectural foundation**, not an implementation plan. Each subsystem (layout, text, theming, a11y, widgets, etc.) graduates to its own design spec later. Implementation phasing lives in `docs/plans/`, not here.
+
+The spec was written during a brainstorming session that consumed three deep-research reports (Bevy UI ecosystem, web platform feature inventory, accessibility deep-dive). Those reports are the substrate for the catalog and inform the architectural decisions.
+
+## Children
+
+This is a multi-file spec. The catalog is split across the children below; the parent (this README) holds goals, sub-spec roadmap, open questions, and references. Children inherit the parent's date.
+
+- [architecture.md](architecture.md) — Architectural foundation: parallel UI stack, primitives we integrate directly, what Buiy owns, authoring (ECS + BSN), theming, a11y, reactivity, module organization, compatibility & policy.
+- [visuals.md](visuals.md) — Document model & component hierarchy, layout, visual styling & rendering.
+- [text.md](text.md) — Typography, text editing.
+- [interaction.md](interaction.md) — Forms, events & input handling, animation & motion.
+- [media-and-widgets.md](media-and-widgets.md) — Media & graphics, widget catalog (APG patterns).
+- [accessibility.md](accessibility.md) — ARIA roles / states / properties, ACCNAME 1.2, focus management, keyboard interaction, screen-reader interop, user preferences, WCAG 2.2 SC enumeration table.
+- [verification.md](verification.md) — Verification pipeline: CI gates, manual release gates, platform matrix, hot-reload trigger flow, tooling.
+- [cross-cutting.md](cross-cutting.md) — i18n, state / data / reactivity, theming, devtools, 3D-anchored UI, compatibility & coexistence with bevy_ui.
+
+Section numbers in cross-references map to children: 3.1–3.3 → visuals, 3.4–3.5 → text, 3.6–3.8 → interaction, 3.9–3.10 → media-and-widgets, 3.11 → accessibility, 3.12–3.14 + 3.16–3.18 → cross-cutting, 3.15 → verification.
+
+## 1. Goals and non-goals
+
+### Buiy's goals (the product)
+
+1. **Comprehensive.** Feature parity with the modern web UI platform: HTML semantics, CSS layout / styling / animation surface area, ARIA roles and states, WAI-ARIA APG behavioral patterns, WCAG 2.2 success criteria, complex text (IME, BiDi, RTL, complex script shaping, emoji), the form-control set, drag-and-drop, clipboard, live regions. The web platform feature catalog produced during research is the master list we cull from, not an aspiration. Future web features (anchor positioning, container queries, view transitions, scroll-driven animations) are absorbable, not blocking.
+
+2. **Accessible.** WCAG 2.2 AA is the floor. Every interactive widget ships with its APG keyboard contract, accessible name/role/value, focus management, AccessKit tree wiring. Forced-colors, reduced-motion, prefers-contrast, prefers-color-scheme are honored automatically from OS preferences.
+
+3. **BSN-native.** Every Buiy component is small, public-fielded, observable, and decomposed by concern. No megacomponents, no private setters. BSN authoring works against Buiy components without adapter layers (the lesson of [bevy issue #17644](https://github.com/bevyengine/bevy/issues/17644)).
+
+4. **Parallel to bevy_ui.** Buiy is a parallel UI stack — it integrates the same underlying primitives that bevy_ui uses (Taffy, cosmic-text, AccessKit, bevy_picking, Bevy's render graph) directly, with its own component model and render pipeline. The decision to go parallel rather than build on top of bevy_ui follows from the comprehensive-feature-parity goal: bevy_ui's renderer caps several capabilities (non-rect clipping, backdrop-filter, mix-blend-mode, isolation, true top layer) that web parity requires.
+
+5. **Tracks Bevy.** Rolling latest-stable. No multi-version compatibility promise. Each Bevy minor release is a migration event for Buiy users.
+
+6. **Game and app, both.** Buiy is the UI layer for anything built on Bevy. Productivity-app concerns (IME, complex text, screen readers, complex forms) and game concerns (gamepad nav, in-world UI anchoring, animation polish) are both in scope.
+
+7. **Verifiable.** Every machine-testable claim Buiy makes (every widget behavior with a defined keyboard contract, every AccessKit tree shape, every theme variant's visual output, every layout primitive's resolved geometry, every machine-testable WCAG SC) is covered by automated tests that run in CI without a human approval gate. Claims that depend on human judgment, real OS subsystems, or physical devices (real-SR utterance verification, full OS-IME conformance, real-device mobile coverage, content-quality SCs, subjective visual quality) are documented as **manual release gates** with explicit owners, cadence, and release-blocking sign-off documents — not CI gates. [verification.md](verification.md) enumerates which tests live in CI vs at the manual release gate. Tradeoff acknowledgment: several user-experience claims (what an AT actually says, what real devices do, content quality, polish) sit at the manual tier; "fully automated verification pipeline" describes the CI tier specifically.
+
+### Non-goals
+
+- **Networking, persistence, routing/URL navigation, file system access, service workers, sandboxing.** UI is a presentation layer; data and transport are the consuming app's concern.
+- **Game-side accessibility content** — audio description of gameplay, difficulty options, narrative aids, content warnings. Buiy provides the *UI primitives* (live regions, caption containers, settings widgets, remap UI); the game owns the substance.
+- **A reactive component model with signals/computed/effects in v1.** Bevy's observers + change detection are the reactivity primitive. A signal-style layer is a follow-up sub-spec, not part of foundation.
+- **Compatibility across Bevy minor versions.** Each Bevy minor release is a migration event.
+- **Non-Bevy frontends.** No web target via WASM-without-Bevy, no SSR.
+- **Replacing bevy_ui upstream.** Buiy stands parallel; bevy_ui and Buiy can both run in the same app (different windows).
+- **Mixing Buiy and bevy_ui in the same UI tree (or same window).** See [cross-cutting.md § 3.18](cross-cutting.md).
+
+### What this spec does
+
+- Defines the architectural foundation: parallel to bevy_ui, BSN-friendly components, ECS + BSN authoring, token-based theming, AccessKit-first.
+- Catalogs every feature/component by category, each tagged with a tier: **F** = foundation (without it nothing else works), **C** = core (any non-trivial UI needs it), **E** = extended (commonly needed but cuttable for a long time), **O** = out (explicitly excluded, with reason).
+- Lists the subsystems that will receive their own design specs (Section 4 below).
+- Records open questions for later resolution (Section 5 below).
+
+### What this spec does NOT do
+
+- Specify APIs in detail. Per-subsystem specs do that.
+- Pick release phases or a timeline. Plans do that.
+- Specify a single canonical UI style or design language. The default theme passes WCAG 2.2 AA; visual style is a theme concern.
+
+### Tier legend
+
+**F** = foundation, **C** = core, **E** = extended, **O** = out (excluded, with reason).
+
+A small number of WCAG-tied items in [accessibility.md](accessibility.md) carry **dual tiers** of the form `F (AA) / C (AAA)`, where the conformance level (AA vs AAA) and the Buiy implementation tier differ. The convention applies only there; everywhere else tiers are single-valued.
+
+## 4. Sub-spec roadmap
+
+Each subsystem below graduates to its own design spec at `docs/specs/YYYY-MM-DD-<topic>-design.md` when it's that subsystem's turn to be designed. Each will cite this foundation spec.
+
+| Sub-spec | Scope |
+|---|---|
+| `buiy-render-pipeline-design` | Render passes, top-layer compositing, clipping, filters, blend modes, atlasing, color management, render-graph node ordering. |
+| `buiy-layout-design` | Taffy integration, anchor positioning, container queries, writing-mode integration. |
+| `buiy-text-rendering-design` | cosmic-text integration, atlas management, font registration, fallback. |
+| `buiy-text-editing-design` | IME composition, BiDi caret, undo/redo, multi-line, rich-text edit surface. |
+| `buiy-focus-model-design` | Focus tree, `:focus-visible`, traps, restoration, roving tabindex, gamepad spatial nav. |
+| `buiy-accessibility-design` | AccessKit tree construction, decomposed components, ACCNAME 1.2, live regions, adapter ownership. |
+| `buiy-theme-tokens-design` | Semantic tokens, theme assets, variants, OS-pref binding, contrast linter, APCA upgrade path. |
+| `buiy-widget-catalog-design` | APG patterns shared infrastructure; per-widget specs nest as multi-file children. |
+| `buiy-animation-design` | Transitions, keyframes, layout transitions, springs, reduced-motion gating. |
+| `buiy-forms-design` | Form state machine, constraint validation, validation pseudo-classes, error-message model. |
+| `buiy-input-events-design` | Pointer, keyboard, touch, gamepad, IME, drag-and-drop, `bevy_picking` backend registration + priority, drag a11y replacement contract. |
+| `buiy-i18n-design` | BiDi, vertical writing, ICU, locale-aware formatters, calendar/numbering systems. |
+| `buiy-3d-anchored-ui-design` | Billboards, worldspace UI, render-to-texture surface API, hit-testing. |
+| `buiy-verification-design` | Automated pipeline, harness API, WCAG-SC test fixtures + tolerances, CI matrix, manual release-gate cadences, perf baselines, `--accept` workflow. |
+| `buiy-devtools-design` | Inspector, overlays, contrast checker, focus visualizer, theme editor. |
+| `buiy-bsn-integration-design` | BSN authoring helpers, decomposed-component conventions, reflection-registration ergonomics, hot-reload semantics including component reload. |
+| `buiy-asset-pipeline-design` | Theme assets, font assets, `.bsn` assets, icon atlases, vector assets, hot-reload semantics, asset GC, atlas-warmup strategy. |
+| `buiy-coexistence-design` | (Conditional sub-spec — only if same-window coexistence with bevy_ui becomes required.) AccessKit-adapter coordinator, render-pass ordering across stacks, picking-backend priority across stacks, IME ownership, focus arbitration. |
+| `buiy-window-and-surface-design` | Multi-window, render targets, render-to-texture contracts, off-screen rendering, fullscreen surface, top-layer per-window. |
+| `buiy-clipboard-and-os-integration-design` | Clipboard, drag-drop OS interop, virtual keyboard hints, spellcheck OS bridge, system-color resolution, OS-preference plumbing. |
+
+Each sub-spec gets one or more plans (`docs/plans/`) for implementation.
+
+## 5. Open questions
+
+- **Final crate split.** Single crate vs multi-crate workspace; if multi-crate, the exact partition. The spec commits to modular subsystems with clean boundaries; the partition can change.
+- **Reactivity layer.** Observers + change detection only in v1. Whether to add a signal/computed/effect primitive in a follow-up sub-spec is open.
+- **CSS-flavored stylesheet.** Never, or as a future layer above tokens? bevy_flair sets one precedent; the right answer depends on user demand.
+- **Date/time pickers — Buiy-owned vs OS-delegated.** Buiy-owned per APG gives consistent visuals; OS-delegated is lighter. Spec defaults to Buiy-owned (consistency), but this is reversible.
+- **WCAG 2.2 SC enforcement strategy.** Per-SC: automated CI check, runtime-honored constraint, or documented design constraint. The mapping table is owned by `buiy-verification-design`.
+- **3D-anchored UI prioritization.** The renderer is ours and `Transform` works, so it's unblocked. Whether `buiy_3d` is concurrent with foundation work or strictly deferred is a planning choice.
+- **Coexistence policy with `bevy_feathers` / `bevy_ui_widgets`.** Coexistence at the app level is committed; whether Buiy ships migration adapters from bevy_ui widgets is open.
+- **Performance budgets — concrete numbers.** The CI gate ([verification.md § CI gate #14](verification.md)) is committed; the per-fixture *budget numbers* (target frame-time per fixture, allowed regression slack) calibrate over time and live in `buiy-verification-design`.
+- **Platform support staging.** All platforms (Windows / macOS / Linux / Android / iOS / web) at v1, or staged?
+- **Hot-reload of components (not just themes).** In scope as part of `buiy-bsn-integration-design`?
+- **Render-to-texture surface API contract.** Feeds `buiy_3d`; the boundary is open.
+- **Animation library substrate.** Roll our own springs, depend on `bevy_animation`, or wrap an existing crate?
+- **OS spellchecker integration.** Where the OS exposes a spellchecker, Buiy uses it; where not, software fallback. The fallback library choice is open.
+- **Real screen-reader testing in CI.** Currently out of CI (manual at release). If this becomes feasible (e.g., headless NVDA via vmnv tools), it becomes a CI gate.
+- **AccessKit-adapter ownership when both stacks coexist same-window.** Currently the spec rules this out (per-window coexistence only). If demand arises, `buiy-coexistence-design` defines the coordinator.
+- **AccessKit cadence policy decoupled from Bevy.** Whether AccessKit major releases between Bevy minors trigger a Buiy patch release with explicit semver, or are absorbed silently.
+- **Reflection-registration ergonomics for BSN consumers.** Whether `register_type` calls are emitted by a derive macro on Buiy components, by a sub-plugin per crate, or by a single global plugin call.
+- **Bevy WASM target policy.** Bevy supports WASM; the spec lists "non-Bevy frontends" as out, but Bevy-on-WASM is an in-scope Bevy target. Web a11y waits for AccessKit's web adapter; visual / input / layout work on WASM today. Whether v1 commits to WASM as a target platform is open.
+- **Wayland vs X11 a11y differences.** AT-SPI behavior diverges between session types; whether Buiy ships Wayland-specific code paths or assumes AT-SPI parity is open.
+- **APCA gate or advisory.** Currently APCA is advisory; WCAG 2 ratios are the gate. If WCAG 3 (which incorporates APCA) reaches recommendation status, the gate flips.
+- **Real-device mobile CI staging.** [verification.md](verification.md) punts Android / iOS to manual release gate. Open question: budget and timeline for moving them into CI.
+- **Crate-split refinement.** [architecture.md § 2.8](architecture.md) lists `buiy_core` as containing render + layout + focus + theme + a11y primitives. That may be too coarse; splitting into `buiy_render`, `buiy_a11y`, `buiy_layout`, `buiy_focus`, `buiy_theme` is open.
+
+## References
+
+- Bevy UI ecosystem report (research input, May 2026).
+- Web platform UI feature catalog (research input, May 2026).
+- Accessibility deep-dive (research input, May 2026).
+- WAI-ARIA 1.2 — https://www.w3.org/TR/wai-aria-1.2/
+- ARIA Authoring Practices Guide — https://www.w3.org/WAI/ARIA/apg/
+- Accessible Name and Description Computation 1.2 — https://www.w3.org/TR/accname-1.2/
+- WCAG 2.2 — https://www.w3.org/TR/WCAG22/
+- AccessKit — https://accesskit.dev
+- Bevy issue #17644 (`bevy_a11y` BSN-incompatibility, lesson source) — https://github.com/bevyengine/bevy/issues/17644
+- Bevy discussion #14437 (BSN tracking) — https://github.com/bevyengine/bevy/discussions/14437
+- Bevy discussion #16900 (Standard Headless Widgets) — https://github.com/bevyengine/bevy/discussions/16900
+- Bevy issue #11100 (10 Challenges for Bevy UI Frameworks) — https://github.com/bevyengine/bevy/discussions/11100
diff --git a/docs/specs/2026-05-07-buiy-foundation/accessibility.md b/docs/specs/2026-05-07-buiy-foundation/accessibility.md
new file mode 100644
index 0000000..e655150
--- /dev/null
+++ b/docs/specs/2026-05-07-buiy-foundation/accessibility.md
@@ -0,0 +1,167 @@
+# Feature inventory — accessibility (ARIA + WCAG 2.2)
+
+**Parent:** [README.md](README.md)
+
+Tier legend: **F** = foundation, **C** = core, **E** = extended, **O** = out (excluded, with reason). See [README.md § Tier legend](README.md#tier-legend).
+
+A small number of WCAG-tied items in this section carry **dual tiers** of the form `F (AA) / C (AAA)`, where the conformance level (AA vs AAA) and the Buiy implementation tier (foundation vs core) differ. This convention applies only here.
+
+## 3.11 Accessibility (ARIA + WCAG 2.2)
+
+**ARIA roles taxonomy** — full enumeration, mapped to AccessKit `Role`.
+
+- **Landmarks (8):** banner, complementary, contentinfo, form, main, navigation, region, search. **F**
+- **Document structure (38):** article, blockquote, caption, cell, code, columnheader, definition, deletion, document, emphasis, feed, figure, generic, group, heading, img / image (`img` and `image` are interchangeable tokens in ARIA 1.2), insertion, list, listitem, mark, math, meter, none / presentation, note, paragraph, row, rowgroup, rowheader, separator (non-focusable), strong, subscript, superscript, suggestion, table, term, time, toolbar, tooltip. **F**
+- **Deprecated and not implemented:** `directory` (deprecated in ARIA 1.2). **O**
+- **Standalone widgets (20):** button, checkbox, gridcell, link, menuitem, menuitemcheckbox, menuitemradio, option, progressbar, radio, scrollbar, searchbox, separator (focusable), slider, spinbutton, switch, tab, tabpanel, textbox, treeitem. **F**
+- **Composite widgets (9):** combobox, grid, listbox, menu, menubar, radiogroup, tablist, tree, treegrid. **F**
+- **Live region — alert, log, status, timer.** **F**
+- **Live region — marquee** (legacy, deprecated-leaning). **E**
+- **Window (2):** alertdialog, dialog. **F**
+
+**ARIA states & properties**
+
+- **Widget states:** `aria-busy`, `aria-checked` (`true` / `false` / `mixed`), `aria-disabled`, `aria-expanded`, `aria-hidden`, `aria-invalid` (`true` / `false` / `grammar` / `spelling`), `aria-pressed` (`true` / `false` / `mixed`), `aria-selected`. **F**
+- **Widget properties:** `aria-autocomplete` (`none` / `inline` / `list` / `both`), `aria-haspopup` (`false` / `true` / `menu` / `listbox` / `tree` / `grid` / `dialog`), `aria-label`, `aria-level`, `aria-modal`, `aria-multiline`, `aria-multiselectable`, `aria-orientation` (`horizontal` / `vertical`), `aria-placeholder`, `aria-readonly`, `aria-required`, `aria-sort` (`ascending` / `descending` / `none` / `other`), `aria-valuemax`, `aria-valuemin`, `aria-valuenow`, `aria-valuetext`. **F**
+- **Live region:** `aria-live` (`off` / `polite` / `assertive`), `aria-atomic`, `aria-relevant` (`additions` / `removals` / `text` / `all`), `aria-busy`. **F**
+- **Drag/drop ARIA:** `aria-grabbed`, `aria-dropeffect` deprecated in ARIA 1.2 — **not implemented**. **O** Replacement contract: every drag-driven widget exposes (a) a `Move-to`-style action via AccessKit (`Increment` / `Decrement` for ordered lists, custom action for arbitrary positioning), (b) a keyboard alternative per WCAG 2.5.7, (c) a polite live-region announcement on drag start / drag end / drop / cancel. Spec'd in `buiy-input-events-design`.
+- **Relationships:** `aria-activedescendant`, `aria-colcount`, `aria-colindex`, `aria-colindextext`, `aria-colspan`, `aria-controls`, `aria-describedby`, `aria-description`, `aria-details`, `aria-errormessage`, `aria-flowto`, `aria-labelledby`, `aria-owns`, `aria-posinset`, `aria-rowcount`, `aria-rowindex`, `aria-rowindextext`, `aria-rowspan`, `aria-setsize`. **F**
+- **Global (foundation):** `aria-current` (`page` / `step` / `location` / `date` / `time` / `true` / `false`), `aria-keyshortcuts` (required for menu / button-with-shortcut widgets and WCAG 2.1.4), `aria-roledescription`. **F**
+- **Global (core):** `aria-braillelabel`, `aria-brailleroledescription` (only emitted when AT requests braille; AccessKit-supported). **C**
+- **`aria-details` vs `aria-describedby` policy** — `aria-describedby` is for short flat text references (descriptive labels). `aria-details` is for rich / structured supporting content (long descriptions, tables, footnotes). Per-widget contracts in `buiy-widget-catalog-design` specify which to emit.
+
+**Accessible Name and Description Computation (ACCNAME 1.2)**
+- Full algorithm implemented in `buiy_core`. **F**
+- Name from `aria-labelledby` > `aria-label` > host-language label > content > `title`. **F**
+- Description from `aria-describedby` > `aria-description` > host-language > `title`. **F**
+- Hidden subtree exclusion rules. **F**
+
+**Live regions and announcements**
+- Politeness levels (off / polite / assertive). **F**
+- `aria-atomic`, `aria-busy`, `aria-relevant`. **F**
+- `role=status`, `role=alert`, `role=log`, `role=timer`. **F**
+- `role=marquee`. **E**
+- Global announcer service for ad-hoc announcements. **F**
+- Locale-aware accessible-name composition (number / date formatting inside names; `lang`-switching mid-string in `aria-labelledby` chains). **C**
+
+**Focus management**
+- `:focus-visible` semantics. **F**
+- Focus ring: ≥2 px perimeter, ≥3:1 contrast vs unfocused (WCAG 2.4.11). **F**
+- Focus-not-obscured (WCAG 2.4.11 AA, 2.4.12 AAA). **F** (AA), **C** (AAA)
+- Focus appearance enhanced (WCAG 2.4.13 AAA). **C**
+- Focus trap for modal dialogs (auto for `Dialog` / `AlertDialog`). **F**
+- Focus restoration on overlay close. **F**
+- Inert subtrees (excluded from focus + AccessKit + hit-testing). **F**
+- Roving tabindex pattern. **F**
+- `aria-activedescendant` strategy. **F**
+- Sequential focus navigation starting point. **F**
+- Skip-link primitive (visible on focus, jumps to main / a region). **F**
+
+**Keyboard interaction patterns** (per APG)
+- Tab / Shift+Tab between widgets. **F**
+- Arrow keys within composite widgets. **F**
+- Home / End, PgUp / PgDn for long lists / sliders. **F**
+- Enter / Space to activate. **F**
+- Escape to dismiss / close. **F**
+- Type-ahead (first-letter search) in menus / listboxes / comboboxes. **F**
+- F2 to enter edit mode (grid). **C**
+- Per-widget contracts enumerated in `buiy-widget-catalog-design`.
+
+**Screen reader interop**
+- AccessKit drives Windows UIA, macOS NSAccessibility, Linux AT-SPI (X11 + Wayland), Android TalkBack, iOS UIAccessibility (in progress upstream), web ARIA (planned upstream). **F**
+- Tested against: NVDA, JAWS, Narrator, VoiceOver (mac/iOS), Orca, TalkBack. **F** (via verification harness — see [verification.md](verification.md))
+- Braille via OS where AccessKit + OS support. **C**
+
+**User preferences**
+- `prefers-color-scheme: light | dark`. **F**
+- `prefers-reduced-motion`. **F**
+- `prefers-reduced-transparency`. **C**
+- `prefers-contrast: no-preference | more | less | custom`. **C**
+- `prefers-reduced-data`. **E**
+- `forced-colors: active | none` + system color keywords. **F**
+- `inverted-colors`. **E**
+
+**Visual a11y**
+- Contrast: WCAG 1.4.3 AA (4.5:1 / 3:1 large), 1.4.6 AAA (7:1 / 4.5:1), 1.4.11 non-text 3:1. **F** (AA), **C** (AAA)
+- APCA contrast utility alongside WCAG 2 ratios. **C**
+- Text resizing 200% (1.4.4). **F**
+- Reflow at 320 CSS px (1.4.10). **F**
+- Text spacing (1.4.12: line-height ≥1.5×, paragraph spacing ≥2× font, letter-spacing ≥0.12em, word-spacing ≥0.16em). **F**
+- Content on hover/focus dismissable (1.4.13). **F**
+- Pointer target size 24×24 (2.5.8 AA), 44×44 (2.5.5 AAA). **F** (AA), **C** (AAA)
+- WCAG 2.5.7 dragging movements alternative for every drag-driven widget. **F**
+- WCAG 2.3.1 three-flashes (max 3 flashes/sec). **F**
+- No content reliant on color alone (1.4.1). **F**
+
+**WCAG 2.2 Success Criteria — full Level A and Level AA enumeration**
+
+Each SC is mapped to one of four enforcement strategies. **CI** = automated check in the verification pipeline. **RT** = runtime-honored constraint (e.g., reduced-motion is read each frame). **LR** = lint-with-review (machine-flagged, human-confirmed at release; not a CI gate). **DC** = design constraint Buiy enables but cannot enforce (content-quality SCs the consuming app owns). **OOS** = out of scope, with reason. AAA SCs are aspirational and listed at the end.
+
+| SC | Title | Level | Strategy | Notes |
+|---|---|---|---|---|
+| 1.1.1 | Non-text Content | A | DC + LR | Buiy requires a non-empty `Image.alt` field unless explicitly marked `Decoration`; lint flags missing alt text. |
+| 1.2.1 | Audio-only / Video-only (Prerecorded) | A | DC | Media widget exposes alternative-content slot; quality is app concern. |
+| 1.2.2 | Captions (Prerecorded) | A | DC | VTT-track support in media widget. |
+| 1.2.3 | Audio Description / Media Alternative (Prerecorded) | A | DC | Description-track slot; app owns content. |
+| 1.2.4 | Captions (Live) | AA | DC | Live-caption stream slot; app owns transcription. |
+| 1.2.5 | Audio Description (Prerecorded) | AA | DC | Same as 1.2.3 quality. |
+| 1.3.1 | Info and Relationships | A | CI | AccessKit tree shape verifies role + parent/child + relationships. |
+| 1.3.2 | Meaningful Sequence | A | CI | Tree order matches visual reading order; verified by snapshot. |
+| 1.3.3 | Sensory Characteristics | A | DC | Don't rely on shape/color/sound alone — content concern. |
+| 1.3.4 | Orientation | AA | RT + CI | No locked orientation; verified across portrait + landscape fixtures. |
+| 1.3.5 | Identify Input Purpose | AA | CI | `autocomplete` token list per input; lint enforces presence on form fields. |
+| 1.4.1 | Use of Color | A | DC | Don't encode meaning in color alone; default theme + linter advise. |
+| 1.4.2 | Audio Control | A | DC | Media widget surfaces controls; app uses them. |
+| 1.4.3 | Contrast (Minimum) | AA | CI | Contrast linter validates every theme + token combination at 4.5:1 / 3:1. |
+| 1.4.4 | Resize Text | AA | CI | 200% zoom fixture + reflow snapshots. |
+| 1.4.5 | Images of Text | AA | LR | Linter advises against image-of-text icons; release review confirms. |
+| 1.4.10 | Reflow | AA | CI | 320 CSS-px width fixture. |
+| 1.4.11 | Non-text Contrast | AA | CI | Linter validates UI controls + state indicators at 3:1. |
+| 1.4.12 | Text Spacing | AA | CI | Forced text-spacing fixture verifies layout doesn't clip. |
+| 1.4.13 | Content on Hover or Focus | AA | CI | Tooltip / Popover contracts assert dismissable / hoverable / persistent. |
+| 2.1.1 | Keyboard | A | CI | APG keyboard contract suite — every interactive widget operable. |
+| 2.1.2 | No Keyboard Trap | A | CI | Focus-traversal property test exits every widget. |
+| 2.1.4 | Character Key Shortcuts | A | CI | `aria-keyshortcuts` registration + remap policy verified. |
+| 2.2.1 | Timing Adjustable | A | DC | App-level timing; Buiy widgets default to no timeout. |
+| 2.2.2 | Pause, Stop, Hide | A | CI | Carousel + Feed + Toast assert pause/stop controls. |
+| 2.3.1 | Three Flashes or Below | A | CI | Animation flash detector in CI. |
+| 2.4.1 | Bypass Blocks | A | CI | Skip-link primitive + landmark navigation present in fixture. |
+| 2.4.2 | Page Titled | A | RT | Window title plumbed through AccessKit. |
+| 2.4.3 | Focus Order | A | CI | Tab-order snapshot per widget. |
+| 2.4.4 | Link Purpose (In Context) | A | LR | Linter advises on empty / generic link names. |
+| 2.4.5 | Multiple Ways | AA | DC | App routing concern. |
+| 2.4.6 | Headings and Labels | AA | LR | Linter advises on missing / generic headings + labels. |
+| 2.4.7 | Focus Visible | AA | CI | Focus-ring rendering verified on every focusable widget. |
+| 2.4.11 | Focus Not Obscured (Minimum) | AA | CI | Sticky toolbar + modal fixtures verify focused element clear. |
+| 2.4.12 | Focus Not Obscured (Enhanced) | AAA | CI (aspirational) | Focused element fully unobscured (vs Minimum's "not entirely hidden"). |
+| 2.4.13 | Focus Appearance | AAA | CI (aspirational) | ≥2 px perimeter, ≥3:1 contrast vs unfocused. |
+| 2.5.1 | Pointer Gestures | A | CI | Multi-pointer / path gestures all have single-pointer fallback. |
+| 2.5.2 | Pointer Cancellation | A | CI | Activation on up-event with drag-off-cancel verified. |
+| 2.5.3 | Label in Name | A | CI | Visible label text is part of accessible name (linter). |
+| 2.5.4 | Motion Actuation | A | DC | Motion-driven actions have alternatives at app level. |
+| 2.5.7 | Dragging Movements | AA | CI | Every drag widget exposes a keyboard alternative; tested. |
+| 2.5.8 | Target Size (Minimum) | AA | CI | Hit-target linter ≥24×24. |
+| 3.1.1 | Language of Page | A | RT | Locale resource published to AccessKit. |
+| 3.1.2 | Language of Parts | AA | RT | Per-text-component lang plumbed. |
+| 3.2.1 | On Focus | A | CI | Focus events do not trigger context changes (linter). |
+| 3.2.2 | On Input | A | CI | Input events do not auto-submit / navigate (linter). |
+| 3.2.3 | Consistent Navigation | AA | DC | App owns layout consistency. |
+| 3.2.4 | Consistent Identification | AA | DC | Buiy widget catalog provides consistent identifiers. |
+| 3.2.6 | Consistent Help | A | DC | App places Help widget; Buiy renders it consistently. |
+| 3.3.1 | Error Identification | A | CI | Error-message model per [interaction.md § 3.6](interaction.md); verified per form fixture. |
+| 3.3.2 | Labels or Instructions | A | LR | Linter advises on missing labels. |
+| 3.3.3 | Error Suggestion | AA | DC | App provides; Buiy renders via error-message slot. |
+| 3.3.4 | Error Prevention (Legal/Financial/Data) | AA | DC | App owns the policy; Buiy provides confirmation widgets. |
+| 3.3.7 | Redundant Entry | A | RT | Form state retains values across navigation; verified. |
+| 3.3.8 | Accessible Authentication (Minimum) | AA | CI + DC | CI verifies paste-allowed (no `paste` block) on password / authentication input types and absence of cognitive-puzzle widgets in the default catalog; the SC's spirit (avoid forcing memory / transcription / cognitive tests) is also a design constraint on app authoring. |
+| 4.1.2 | Name, Role, Value | A | CI | AccessKit tree snapshot — the central SC. |
+| 4.1.3 | Status Messages | AA | CI | Live-region announcer + role=status verified. |
+
+**AAA aspirational** — implemented as opt-in or noted as future work: 1.4.6 (7:1 contrast), 1.4.7 (Low or No Background Audio — DC), 1.4.8 (Visual Presentation), 1.4.9 (Images of Text No Exception), 2.1.3 (Keyboard No Exception), 2.2.3 (No Timing), 2.3.3 (Animation from Interactions), 2.4.8 (Location), 2.4.9 (Link Purpose Alone), 2.4.10 (Section Headings), 2.5.5 (Target Size Enhanced — 44×44), 2.5.6 (Concurrent Input Mechanisms — relevant given Buiy's gamepad / keyboard / pointer concurrency goal; aspirational rather than gated), 3.1.3-6 (cognitive content), 3.3.5-6 (help / error prevention all), 3.3.9 (Accessible Authentication Enhanced). 2.4.12 and 2.4.13 are in the main table at AAA tier.
+
+The strategy / coverage details (fixtures, tolerances, runner) live in `buiy-verification-design`. This table is the authoritative SC roster; that sub-spec realizes it.
+
+**Inert / hit testing**
+- `inert` attribute analogue. **F**
+- `pointer-events: none`. **F**
+- `aria-hidden` for decorative subtrees. **F**
diff --git a/docs/specs/2026-05-07-buiy-foundation/architecture.md b/docs/specs/2026-05-07-buiy-foundation/architecture.md
new file mode 100644
index 0000000..509b48c
--- /dev/null
+++ b/docs/specs/2026-05-07-buiy-foundation/architecture.md
@@ -0,0 +1,103 @@
+# Architectural foundation
+
+**Parent:** [README.md](README.md)
+
+## 2.1 One-line summary
+
+Buiy is a parallel UI stack to bevy_ui, integrating the same underlying primitives (Taffy, cosmic-text, AccessKit, bevy_picking, Bevy's render graph) directly, with its own component model and its own render pipeline.
+
+## 2.2 Underlying primitives Buiy integrates directly
+
+- **[Taffy](https://github.com/DioxusLabs/taffy)** — Flexbox, CSS Grid, Block layout. We feed it our component data. As Taffy adds subgrid, container queries, etc., we get them.
+- **[cosmic-text](https://github.com/pop-os/cosmic-text)** — text shaping, BiDi (UAX #9), font fallback, color emoji, RTL. Used directly for both rendering and editing.
+- **[AccessKit](https://accesskit.dev)** — accessibility tree + cross-platform AT bridge. We build trees and push `TreeUpdate`s ourselves with our own decomposed components.
+- **[bevy_picking](https://docs.rs/bevy_picking)** — hit-testing primitive. We feed our hierarchies into it.
+- **Bevy's render graph + wgpu** — our render passes live in Bevy's render graph. Custom shaders for clipping, gradients, borders, filters, blend modes, top layer.
+- **Bevy's ECS, observers, change detection, asset system, input, windowing.** Used throughout. Buiy is a Bevy plugin, not a separate framework.
+
+## 2.3 What Buiy owns
+
+- **Component model** — Buiy components (`buiy::Node`, `buiy::Style`, `buiy::Theme`, focus components, a11y components, animation components). Designed BSN-friendly (small, public-fielded, observable, decomposed). Not derived from `bevy_ui::Node`.
+- **Render pipeline** — custom Bevy render passes that walk Buiy hierarchies. Full control over rounded clipping, `clip-path` shapes, mask-image, backdrop-filter, mix-blend-mode, isolation/groups, true top-layer compositing, gradients in any color space, border-image, drop-shadow.
+- **Layout integration** — drives Taffy ourselves; extends layout (anchor positioning, container queries) without waiting for upstream.
+- **Text pipeline** — cosmic-text → glyph atlas → render pass, owned end-to-end. No per-span fonts, no inheritance leaks, no atlas leaks.
+- **Focus model** — focus tree, `:focus-visible` semantics, focus rings, focus traps, focus restoration, inert subtrees, roving tabindex, `aria-activedescendant`, sequential-focus-navigation-starting-point, spatial gamepad navigation.
+- **A11y integration** — Buiy → AccessKit directly. Decomposed `A11yRole` / `A11yLabel` / `A11yDescription` / `A11yStates` / `A11yRelations` components drive `TreeUpdate`s. ACCNAME 1.2 name computation lives in `buiy_core`.
+- **Theme system** — token assets, hot-reloadable, OS-pref-driven variant binding.
+- **Animation primitives** — property transitions, keyframe timelines, layout transitions, springs, all reduced-motion-gated.
+- **Live regions / global announcer** — Buiy resource that renders polite/assertive announcements through AccessKit.
+- **Form & validation system** — form state machine, constraint validation, validation pseudo-classes.
+- **Devtools** — inspector, layout overlay, AccessKit tree viewer, contrast linter, focus-order visualizer.
+- **3D-anchored / diegetic UI** — first-class achievable; Buiy nodes can live in 3D space against `Transform`. Stays its own subsystem spec.
+- **Verification harness** — test infrastructure for visual regression, AccessKit tree snapshots, synthesized input replay, APG conformance, WCAG SC verification.
+
+## 2.4 Authoring: ECS-native and BSN, both first-class
+
+- **ECS spawn:** `commands.spawn((buiy::Button, OnPress(submit), children![buiy::Text::new("Save")]))`. Always works.
+- **BSN** (Bevy 0.18+): `bsn! { Button [ Text("Save") ] }` or hot-reloadable `.bsn` files.
+
+The BSN-friendliness constraint on every Buiy component is **not optional**:
+
+- Small, public-fielded, observable, decomposed by concern. No megacomponents, no private setters.
+- Every component derives `Reflect + FromReflect + Default + Clone + Component`.
+- Every component is type-registered via `app.register_type::<T>()` in the owning crate's plugin so `.bsn` asset loading can resolve it.
+
+These constraints follow from BSN's reflection-driven asset format (PR #20158) and from the lesson of bevy issue #17644 (megacomponents are BSN-hostile).
+
+## 2.5 Theming: token-based design system
+
+- Themes are **assets**, hot-reloadable.
+- Components consume **semantic tokens** (`color.surface.primary`, `space.4`, `radius.md`, `motion.fast`), never raw values.
+- A theme defines a **palette + scales + variant**. Variants: `light`, `dark`, `high-contrast`, plus user-defined.
+- OS preferences (`prefers-color-scheme`, `prefers-contrast`, `forced-colors`, `prefers-reduced-motion`, `prefers-reduced-transparency`, `inverted-colors`) surface as a `UserPreferences` resource bound to theme variants automatically.
+- Default theme passes WCAG 2.2 AA contrast (4.5:1 / 3:1 / 3:1) by construction. Contrast linter validates custom themes at load and in CI.
+- A subtree can override its theme by carrying a `Theme` component.
+- **CSS-flavored stylesheet is not in this spec.** Future sub-spec if needed.
+
+## 2.6 Accessibility: AccessKit-first
+
+- The AccessKit tree is the source of truth for accessibility. Built lazily (gated on `AccessibilityRequested`), pushed as `TreeUpdate` diffs.
+- Stable `NodeId`s derived from Bevy `Entity`.
+- ACCNAME 1.2 name computation lives in `buiy_core`.
+- Each widget's APG keyboard contract is part of the widget's contract.
+
+**Adapter ownership.** AccessKit allows exactly one tree per `accesskit_winit::Adapter` per window. Buiy owns the adapter handle on any window where Buiy is present, keyed by winit `WindowId` (not Bevy `Entity`). Buiy does *not* layer over `bevy_a11y` — it replaces `bevy_a11y` for windows it owns. `ActionRequest` events from the adapter are routed to Buiy entities via Buiy's own action plumbing, not bevy_a11y's. See [cross-cutting.md § 3.18](cross-cutting.md) for coexistence rules with bevy_ui.
+
+## 2.7 Reactivity
+
+Observers + change detection only. No signal/computed/effect layer in this spec.
+
+## 2.8 Module organization
+
+Buiy ships as a workspace of focused crates. The principle is **modular subsystems with clean boundaries, opt-in surface area**. The exact partition below is an indicative starting point; final partition is an open question (see [README.md § 5](README.md#5-open-questions)):
+
+- `buiy` — meta-crate, re-exports common API, ships top-level `BuiyPlugin`.
+- `buiy_core` — components, render pipeline, layout integration, focus model, theme tokens, a11y primitives, plugin scaffolding (may split further per the open question).
+- `buiy_text` — rich text + IME-correct text editing on cosmic-text.
+- `buiy_widgets` — APG widget catalog.
+- `buiy_animation` — transitions, keyframes, layout transitions, reduced-motion gating.
+- `buiy_forms` — form state machine, validation, constraint pseudo-classes.
+- `buiy_devtools` — inspector, contrast linter, focus visualizer, AccessKit tree viewer.
+- `buiy_3d` — 3D-anchored / diegetic UI.
+- `buiy_bsn` — BSN authoring helpers when on Bevy 0.18+.
+- `buiy_verify` — verification harness; consumed as `dev-dependency` by every other crate; usable by downstream Buiy users.
+
+**`BuiyPlugin` sub-plugin order.** The top-level plugin adds sub-plugins in this order so dependents see their dependencies on construction: `core` → `theme` → `a11y` → `focus` → `input` → `text` → `widgets` → `animation` → `forms` → `devtools`. Render registration happens in `Plugin::finish` (after `RenderApp` exists).
+
+**System-set partitioning.** Per-frame Buiy work is partitioned into named `SystemSet`s, ordered:
+
+```
+BuiySet::Layout → BuiySet::Style → BuiySet::Input → BuiySet::Animate
+              → BuiySet::Picking → BuiySet::A11yUpdate → BuiySet::Render
+```
+
+Sub-specs hang their systems off these labels. UI animations advance in the `Update` schedule against `Time<Virtual>` (not `FixedUpdate`, which is for game logic). Render-app data is extracted via Bevy's standard `ExtractSchedule` from the main world after `BuiySet::Render` completes.
+
+## 2.9 Compatibility & policy
+
+- **Rolling latest-stable Bevy.** Bevy minor releases drive migration events for underlying primitives. wgpu is a version-pinned dependency of Bevy (Bevy re-exports many wgpu types but the wgpu crate is owned upstream); we follow Bevy's pin. AccessKit releases on its own cadence and is **the open question** of [README.md § 5](README.md#5-open-questions): the policy proposed here is "AccessKit major release between Bevy minors triggers a Buiy patch release with a documented migration note," but this is not yet committed. No back-compat across Bevy minors.
+- **MSRV** tracks Bevy's MSRV.
+- **`std` only.** AccessKit requires it.
+- **Platform support — staged.** Desktop (Windows / macOS / Linux) is committed for v1 with full CI coverage. Android (TalkBack), iOS (UIAccessibility — currently in-progress upstream in AccessKit), and web (AccessKit web adapter — not yet shipped) are deferred until each platform's AccessKit adapter exposes a headless harness usable in CI; until then they live as manual-release-gate platforms.
+- **Render passes & picking** — Buiy registers its own render-graph node and its own `bevy_picking` backend. Render-graph node ordering and picking-backend priority versus bevy_ui's own passes / backend are defined per-window (see [cross-cutting.md § 3.18](cross-cutting.md)); Buiy's own passes do not contractually cooperate with bevy_ui's.
+- **Coexistence with bevy_ui** — see [cross-cutting.md § 3.18](cross-cutting.md). Coexistence is **per-window**, not per-app-shared-window.
diff --git a/docs/specs/2026-05-07-buiy-foundation/cross-cutting.md b/docs/specs/2026-05-07-buiy-foundation/cross-cutting.md
new file mode 100644
index 0000000..d407804
--- /dev/null
+++ b/docs/specs/2026-05-07-buiy-foundation/cross-cutting.md
@@ -0,0 +1,108 @@
+# Feature inventory — cross-cutting
+
+**Parent:** [README.md](README.md)
+
+Tier legend: **F** = foundation, **C** = core, **E** = extended, **O** = out (excluded, with reason). See [README.md § Tier legend](README.md#tier-legend).
+
+Cross-cutting categories that don't fit a single subsystem: i18n / locale, state / data / reactivity, theming, devtools, 3D-anchored UI (deferred subsystem), and compatibility / coexistence with bevy_ui.
+
+## 3.12 Internationalization and locale
+
+- `lang` analogue per Buiy text; plumbed to AccessKit for AT pronunciation. **F**
+- `dir` LTR/RTL with full UI mirroring (scrollbars, sliders, progress bars, icons). **F**
+- Logical CSS properties (start/end vs left/right). **F**
+- BiDi UAX #9, full implementation. **F**
+- Vertical writing modes (CJK, Mongolian). **C**
+- ICU MessageFormat 2.0 for translation strings (placeholders, plurals, gender, select, ordinals). **C**
+- Locale-aware formatters: NumberFormat, DateTimeFormat, RelativeTimeFormat, PluralRules, ListFormat, Collator, Segmenter, DisplayNames, DurationFormat. **C**
+- Calendar systems (Gregorian, Hebrew, Islamic, Buddhist, Japanese, Persian). **E**
+- Numbering systems (Latin, Arabic-Indic, others). **E**
+- Pseudolocale support for QA. **E**
+
+## 3.13 State, data, reactivity
+
+- Two-way binding for input value / checked / selected. **F**
+- Form state machine. **F**
+- Validation state propagation. **F**
+- Selection state (single / multi / range with shift-click, ctrl/cmd-toggle). **F**
+- Drag state. **C**
+- Pseudo-class state surface ([interaction.md § 3.7](interaction.md)). **F**
+- Reactivity primitive: Bevy observers + change detection. **F**
+- Signal / computed / effect layer. **O** — explicitly excluded from the foundation. May return as a follow-up sub-spec if usage demands it; the spec does not commit to that.
+- **Out:** History API / URL routing, `localStorage` / `sessionStorage` / `IndexedDB`. UI does not own persistence or routing. **O**
+
+## 3.14 Theming and user preferences
+
+(Most of this is restated from [architecture.md § 2.5](architecture.md) for catalog completeness.)
+
+- Semantic tokens. **F**
+- Theme assets (hot-reloadable). **F**
+- Variants (light / dark / high-contrast / custom). **F**
+- Scales (color, spacing, typography, motion, radius, elevation). **F**
+- Theme inheritance — subtree can carry its own `Theme` component to override. **C**
+- All `prefers-*` queries surfaced as `UserPreferences` resource. **F**
+- Forced-colors mode → token palette swap with system colors. **F**
+- Reduced-motion → animation short-circuit. **F**
+- Color-scheme → variant swap. **F**
+- Color-gamut detection (`(color-gamut: srgb | p3 | rec2020)`). **C**
+- Pointer / hover media features (`(pointer: none|coarse|fine)`, `(hover: none|hover)`). **C**
+- Dynamic-range detection (`(dynamic-range: standard | high)`). **E**
+- CSS-flavored stylesheet — out of this spec; future sub-spec if needed.
+
+## 3.16 Devtools / DX
+
+- Inspector (entity / component view of Buiy hierarchy). **C**
+- Layout overlay (Flexbox / Grid lines, box-model boundaries). **C**
+- AccessKit tree viewer. **C**
+- Contrast checker (live, against current theme). **C**
+- Focus order visualizer (numbered overlay showing tab order). **C**
+- Performance profiler (per-frame layout / render / AccessKit timing). **C**
+- Theme editor (live token tweaking). **C**
+- BSN hot-reload indicator. **C**
+- Verification harness CLI for downstream Buiy users. **C**
+
+## 3.17 3D-anchored UI (deferred subsystem)
+
+- UI panels as billboards in 3D space. **C**
+- UI panels on curved or arbitrary surfaces. **E**
+- Worldspace UI hit-testing through the 3D scene. **C**
+- Diegetic UI (UI that lives "in" the game world — terminals, screens, holograms). **C**
+- Render-to-texture for UI applied to 3D meshes. **C**
+
+This subsystem gets its own design spec (`buiy-3d-anchored-ui-design`). No `UiTransform` / `Transform` divergence to bridge — Buiy nodes use Bevy's general `Transform`.
+
+## 3.18 Compatibility and coexistence
+
+Coexistence with bevy_ui is **per-window**, not per-app-shared-window. AccessKit allows exactly one tree per window adapter; one window cannot host both bevy_ui and Buiy a11y trees simultaneously without a coordinator. The supported model is:
+
+- An app may have multiple windows. Each window is **owned by one stack**: either Buiy or bevy_ui.
+- On a Buiy-owned window: Buiy owns the `accesskit_winit::Adapter`, the render-graph nodes, the `bevy_picking` backend(s), the focus model, the IME consumer. `bevy_a11y` is suppressed for that window. bevy_ui's own systems do not render or interact on that window.
+- On a bevy_ui-owned window: bevy_ui retains its current behavior. Buiy is absent.
+- Inside a single Buiy tree, you do not mix raw `bevy_ui::Node` content. The component models are independent.
+- Migration from a bevy_ui window to a Buiy window is by replacement of the window's UI tree, not by extending bevy_ui components.
+
+**Why per-window, not coordinator-merged.** A merge coordinator (single AccessKit adapter, both stacks pushing subtrees under one root) is theoretically possible but adds a coordination crate, ID-space rules, focus-arbitration rules, and IME-routing rules — meaningful complexity for a use case (mixing Buiy and bevy_ui in one window) the spec does not need. If demand arises later, that becomes a follow-up sub-spec (`buiy-coexistence-design`).
+
+**Coexistence rules — committed:**
+- One stack per window. **F**
+- Window stack assignment is fixed at window creation; **no runtime stack switching** for an existing window in v1. **F**
+- Buiy components do not extend `bevy_ui::Node`. **F**
+- Migration from bevy_ui → Buiy is by per-window replacement. **F**
+- Per-window state keyed by winit `WindowId`: AccessKit adapter, IME consumer, focus tree root, render-graph node group, `bevy_picking` backend filter. **F**
+- Render-graph node ordering, `bevy_picking` backend priority, IME consumer selection, focus arbitration: per-window stack owns these unilaterally on its own window. **F**
+- **`UiPickingPlugin` interaction:** when a Buiy window is present, Buiy's picking backend is filtered to that window via `bevy_picking`'s window-filter. Bevy's default `UiPickingPlugin` (added by `DefaultPlugins`) operates on bevy_ui-owned windows only. If an app is Buiy-only and adds `DefaultPlugins`, `UiPickingPlugin` runs on no windows and is a no-op. **F**
+
+**Excluded entirely**
+- Networking, fetch, XHR, WebSocket, WebRTC, WebTransport. **O**
+- Cookies, localStorage, IndexedDB, service workers, web app manifest, install. **O**
+- File System Access, Web Bluetooth, USB, Serial, MIDI, NFC, geolocation. **O**
+- WebAuthn, Payment Request. **O**
+- Speech recognition / synthesis (game audio, not UI). **O**
+- DRM / EME. **O**
+- `data:` / `blob:` URL schemes. **O**
+- Native iframe / sandbox / cross-origin. **O**
+- Same-origin policy, CORS, CSP. **O**
+- HTML parser quirks mode, document.write, mutation events (deprecated). **O**
+- Print stylesheet (`@media print`, `@page`). **O** — Bevy is not a print target.
+- SMIL animation. **O** — superseded by CSS / WAAPI analogue.
+- Legacy presentational HTML attributes. **O**
diff --git a/docs/specs/2026-05-07-buiy-foundation/interaction.md b/docs/specs/2026-05-07-buiy-foundation/interaction.md
new file mode 100644
index 0000000..78ef22c
--- /dev/null
+++ b/docs/specs/2026-05-07-buiy-foundation/interaction.md
@@ -0,0 +1,219 @@
+# Feature inventory — interaction (forms, events, animation)
+
+**Parent:** [README.md](README.md)
+
+Tier legend: **F** = foundation, **C** = core, **E** = extended, **O** = out (excluded, with reason). See [README.md § Tier legend](README.md#tier-legend).
+
+## 3.6 Forms and input
+
+**Input types**
+- Text, search, tel, url, email, password. **F**
+- Numeric: `number`, `range` (slider). **F**
+- Date / time: `date`, `month`, `week`, `time`, `datetime-local` — Buiy ships full pickers per APG. **C**
+- Special: `color` (color picker), `file` (file picker). **C**
+- Hidden form-state holder (no UI surface; carries form value only). **F**
+- Button-like: `submit`, `reset`, `button`, `image`. **F**
+- Selection: `checkbox` (incl. tri-state via indeterminate), `radio`. **F**
+
+**Other form controls**
+- Select (single + multi). **F**
+- Combobox (textbox + popup). **F**
+- Datalist — autocomplete suggestion source for textboxes / comboboxes. **F**
+- Textarea. **F**
+- Button. **F**
+- Output (computed-result element). **C**
+- Progress, meter (incl. low / high / optimum). **C**
+- Fieldset, legend. **C**
+- Label (with-for or wrapping; ACCNAME 1.2 source). **F**
+- Form (in-process submit/reset semantics; not HTTP). **C**
+- HTML invoker analogue (`command` / `commandfor` attributes — declarative bind from a button to a target's command, e.g. `show-popover`, `close`). **C**
+- `field-sizing: content` — auto-size text inputs to content. **E**
+
+**Constraint validation**
+- Attributes: `required`, `pattern`, `min`, `max`, `step`, `minlength`, `maxlength`, `multiple`. **F**
+- ValidityState analogue: `valueMissing`, `typeMismatch`, `patternMismatch`, `tooLong`, `tooShort`, `rangeUnderflow`, `rangeOverflow`, `stepMismatch`, `badInput`, `customError`. **F**
+- `setCustomValidity` / `reportValidity` / `checkValidity`. **F**
+- Pseudo-class state: `:required`, `:optional`, `:valid`, `:invalid`, `:user-valid`, `:user-invalid`, `:in-range`, `:out-of-range`, `:placeholder-shown`, `:read-only`, `:read-write`, `:default`, `:checked`, `:indeterminate`, `:disabled`, `:enabled`. **F**
+- Form-associated custom components (analogue of `ElementInternals`). **C**
+
+**Error message model** (WCAG 3.3.1 / 3.3.3 / 3.3.4)
+- Each form control carries an error-message slot routed via the `aria-errormessage` analogue. **F**
+- Error messages are live-region-aware: announced on validation failure via the global announcer. **F**
+- Per-form error summary primitive (lists invalid fields, links to each). **C**
+- Suggestion / fix proposal (3.3.3) is an authoring concern; Buiy provides the slot + aria wiring. **C**
+
+**WCAG 2.2 form-specific SCs**
+- WCAG 3.3.7 Redundant Entry (**Level A**) — form-state machine retains values across navigation; per-field "remember me" hooks. **C**
+- WCAG 3.3.8 Accessible Authentication (Minimum, **Level AA**) — Buiy provides paste-friendly password fields, optional copy from clipboard, and avoids cognitive-only verification UIs by default. Paste-not-blocked is a CI gate. **F**
+- WCAG 3.3.9 Accessible Authentication (Enhanced, **Level AAA**) — strict no-cognitive-test mode opt-in. **E**
+- WCAG 3.2.6 Consistent Help (**Level A**) — apps own help placement; Buiy widget catalog ensures Help / Tooltip / Disclosure widgets render consistently. **C**
+
+**State**
+- `disabled`, `readonly`, `autofocus`, `name`, `value`, `placeholder`. **F**
+- `autocomplete` token list (WCAG 1.3.5 input purpose). **C**
+- Form state machine (pristine / dirty / touched / visited / valid). **F**
+- Validation state propagation up forms / fieldsets. **F**
+
+**File handling**
+- File picker (single + multiple). **C**
+- `accept` filter. **C**
+- File drag-and-drop into a target. **C**
+- Camera / mic capture. **E**
+- Directory upload. **E**
+
+**Out:** HTTP form submission, browser autofill credential store integration. **O**
+
+## 3.7 Events and input handling
+
+**Mouse events**
+- `mousedown`, `mouseup`, `click`, `dblclick`, `auxclick`, `contextmenu`, `mouseenter`, `mouseleave`, `mouseover`, `mouseout`, `mousemove`. **F**
+- Coordinates: client / page / screen / offset / movement. **F**
+- Buttons + modifiers. **F**
+
+**Pointer events** (unified, primary input model)
+- `pointerdown` / `pointerup` / `pointermove` / `pointercancel` / `pointerover` / `pointerout` / `pointerenter` / `pointerleave` / `pointerrawupdate`. **F**
+- `gotpointercapture` / `lostpointercapture`. **C**
+- `pointerType` (mouse / touch / pen). **F**
+- `pressure`, `tangentialPressure`, `tiltX/Y`, `twist`, `width`, `height` (pen / stylus fidelity). **C**
+- `isPrimary`. **F**
+- Pointer capture. **F**
+
+**Touch events**
+- `touchstart` / `touchmove` / `touchend` / `touchcancel`. **C**
+- Multi-touch via stable identifiers. **C**
+- Gesture primitives: pinch, rotate, swipe, long-press, double-tap. **C**
+
+**Keyboard events**
+- `keydown` / `keyup` / `beforeinput` / `input`. **F**
+- Logical key (`KeyboardEvent.key`), physical code (`code`), repeat, location, modifiers, `isComposing`. **F**
+- IME composition events. **F**
+- Keyboard shortcut binding (`aria-keyshortcuts` analogue). **F** — every menu / button-with-shortcut widget needs it for APG conformance and WCAG 2.1.4.
+- Global keyboard shortcut activation (`accesskey` analogue + window-level chord registration; OS-conflict policy: shortcuts that collide with OS / IME modifiers are rejected at registration time). **F**
+- Single-key shortcut remap policy (per WCAG 2.1.4): every single-key shortcut is opt-in or remappable, suppressible while a textbox has focus. **F**
+- `InputEvent.inputType` taxonomy (`insertText`, `deleteContentBackward`, `historyUndo`, `formatBold`, etc.) for editing semantics. **C**
+- Keyboard layout map (logical-to-physical, locale-aware). **E**
+
+**Gamepad** — first-class
+- Standard mappings (DPad / sticks / face buttons / triggers / shoulder / start / select). **F**
+- Logical actions (navigate / activate / back / context-menu), remappable. **F**
+- Spatial focus navigation (DPad / left stick → geometric focus movement). **F**
+- Analog inputs for sliders, scrollers, draggables. **C**
+
+**Wheel / scroll**
+- `wheel` event with `deltaX/Y/Z` and `deltaMode`. **F**
+- `scroll` event. **F**
+- `scrollend` event. **C**
+- Smooth scrolling, scroll snap, momentum. **C**
+
+**Drag and drop**
+- Lifecycle: `dragstart`, `drag`, `dragend`, `dragenter`, `dragover`, `dragleave`, `drop`. **C**
+- DataTransfer analogue. **C**
+- OS drag-source / drag-target interop. **C**
+- Every drag-driven Buiy widget ships a keyboard alternative (WCAG 2.5.7). **F**
+
+**Focus events**
+- `focus` / `blur` (non-bubbling). **F**
+- `focusin` / `focusout` (bubbling). **F**
+- `:focus-visible` heuristic. **F**
+- `relatedTarget`. **C**
+
+**Form events**
+- `input`, `change`, `submit`, `reset`, `invalid`, `formdata`, `beforeinput`. **F**
+- `selectionchange`, `select`. **C**
+
+**Clipboard**
+- `copy`, `cut`, `paste` events. **F**
+- Programmatic clipboard read/write (text + HTML + image MIME). **C**
+- OS clipboard format negotiation. **C**
+
+**Event flow**
+- Capture → target → bubble. **F**
+- `stopPropagation`, `stopImmediatePropagation`, `preventDefault`. **F**
+- Listener options: `passive`, `once`, `signal`, `capture`. **C**
+- Synthetic / dispatched events. **C**
+
+**Pseudo-class state surface (interactive)**
+- `:hover`, `:active`, `:focus`, `:focus-visible`, `:focus-within`, `:target`. **F**
+- `:has()` (dependent-state selector). **C**
+- `:is()`, `:where()`, `:not()`. **C**
+- `:dir(ltr | rtl)`, `:lang(<code>)`. **F** — required given RTL is a foundation goal.
+- `:state(<custom>)` — Custom State Pseudo-class API for form-associated custom widgets. **C**
+- `:fullscreen` — true when subtree is the active fullscreen surface. **C**
+- `:modal` — true when subtree is an open modal `Dialog` or `AlertDialog`. **C**
+- `:popover-open` — true when popover element is open (auto / manual / hint). **C**
+
+**Pseudo-class state surface (structural)**
+- `:nth-child(<an+b>)`, `:nth-of-type(<an+b>)`, `:nth-last-child`, `:nth-last-of-type`. **C**
+- `:first-child`, `:last-child`, `:only-child`, `:first-of-type`, `:last-of-type`, `:only-of-type`. **C**
+- `:empty`. **C**
+- `:root`, `:scope`. **C**
+
+**Pseudo-elements**
+- `::before`, `::after` — generated content / decorative inserts. **C**
+- `::backdrop` — modal / dialog / fullscreen backdrop styling. **F**
+- `::selection`. **F**
+- `::placeholder`. **F**
+- `::marker` (list bullets). **C**
+- `::highlight(<name>)` — Custom Highlight API for collaborative highlights, find-in-page, custom underline ranges. **E**
+- `::file-selector-button`. **C**
+- `::part(<name>)`, `::slotted(<selector>)` — Shadow-DOM-style component-encapsulation pseudo-elements. **E**
+- `::details-content` — disclosure / `<details>` open state content. **C**
+- `::view-transition`, `::view-transition-group`, `::view-transition-image-pair`, `::view-transition-old`, `::view-transition-new` — view transition pseudo-elements (paired with § 3.8 below). **C**
+- `::spelling-error`, `::grammar-error`. **E**
+- `::first-letter`, `::first-line`. **E**
+- `::target-text` (text fragments). **E**
+
+**Observers** (programmatic observation primitives, analogous to web Observer APIs)
+- `IntersectionObserver` analogue — observe when a node enters / leaves viewport or another node. **C** — required for lazy-load, virtualization, scroll-based reveal.
+- `ResizeObserver` analogue — observe size changes on a node. **C** — required for container-query authors and responsive components.
+- `MutationObserver` analogue — observe subtree mutations beyond Bevy's per-component change-detection. **C**
+- `PerformanceObserver` analogue — observe per-frame layout / render / a11y-update timings. **E**
+
+**At-rules / cascade primitives**
+- Token cascade is Buiy-native; CSS at-rules (`@media`, `@supports`, `@layer`, `@scope`, `@import`) are not the primary expression. The features they expose are reified differently:
+  - User-preference media-query equivalents (`prefers-color-scheme`, `prefers-contrast`, `forced-colors`, `prefers-reduced-motion`, `prefers-reduced-transparency`, `inverted-colors`) live in the `UserPreferences` resource. **F**
+  - Capability media-query equivalents (`pointer: none|coarse|fine`, `hover: none|hover`). **C**
+  - Display media-query equivalents (`color-gamut: srgb|p3|rec2020`, `dynamic-range: standard|high`). **C**
+  - Container-query units (`cqw / cqh / cqi / cqb / cqmin / cqmax`). **C** — see [visuals.md § 3.2](visuals.md).
+  - Feature-detection (`@supports`) reifies as runtime capability resources (e.g., `RenderCapabilities`). **C**
+  - Cascade layering (`@layer`) is unnecessary because Buiy doesn't ship a stylesheet language; theme override priority is explicit (subtree `Theme` component). **O**
+  - `@scope` is unnecessary for the same reason. **O**
+  - CSS nesting (`& selector`) — irrelevant without a stylesheet. **O**
+
+**Out:** deprecated DOM mutation events, web's `Event.isTrusted` security flag (Buiy events are all in-process; the verification harness in [verification.md](verification.md) *does* synthesize input events for testing — this is unrelated to the web's trusted-vs-synthetic distinction), hashchange / popstate. **O**
+
+## 3.8 Animation and motion
+
+**Property transitions** (CSS Transitions analogue)
+- Transition any animatable property on state change. **F**
+- `transition-property` / `-duration` / `-timing-function` / `-delay` / `-behavior` (allow-discrete). **F**
+- Timing functions: `linear()` (multi-stop), `ease`, `ease-in/out/in-out`, `cubic-bezier()`, `steps()`, `step-start/end`. **C**
+- Discrete property transitions (e.g., display) via `@starting-style` analogue. **C**
+- `interpolate-size: allow-keywords` analogue — animate to/from intrinsic-size keywords (`auto`, `min-content`, `max-content`, `fit-content`). **C**
+- Transition lifecycle events. **C**
+
+**Keyframe animations** (CSS Animations analogue)
+- Keyframes (from / to / percentages, named timelines). **F**
+- Animation properties: name, duration, timing, delay, iteration-count, direction, fill-mode, play-state, composition, timeline, range. **C**
+- Animation lifecycle events. **C**
+
+**Programmatic animation API** (Web Animations API analogue)
+- Per-element programmatic control: play, pause, reverse, finish, cancel, playback rate. **C**
+- Composite operations (replace / add / accumulate). **E**
+
+**Layout transitions** (View Transitions analogue)
+- Animate layout changes (size, position) automatically when state changes. **C**
+- Cross-state snapshots. **C**
+- Per-element view-transition names. **C**
+
+**Scroll-driven animations**
+- Scroll timeline, view timeline. **E**
+
+**Game-flavored animation**
+- Spring physics primitives. **C**
+- Timeline composition (sequence, parallel). **C**
+
+**Reduced motion**
+- All animations short-circuit under `prefers-reduced-motion: reduce`. **F**
+- WCAG 2.3.1 — no flashes >3/sec; flash detection in CI. **F**
+- WCAG 2.3.3 — animation from interactions respects reduced-motion. **F**
diff --git a/docs/specs/2026-05-07-buiy-foundation/media-and-widgets.md b/docs/specs/2026-05-07-buiy-foundation/media-and-widgets.md
new file mode 100644
index 0000000..644eea8
--- /dev/null
+++ b/docs/specs/2026-05-07-buiy-foundation/media-and-widgets.md
@@ -0,0 +1,110 @@
+# Feature inventory — media & widgets
+
+**Parent:** [README.md](README.md)
+
+Tier legend: **F** = foundation, **C** = core, **E** = extended, **O** = out (excluded, with reason). See [README.md § Tier legend](README.md#tier-legend).
+
+## 3.9 Media and graphics
+
+**Images**
+- Image rendering with DPR-aware variants (srcset / sizes analogues). **C**
+- `<picture>` art-direction analogue — multiple sources with media-condition switching (e.g., aspect-ratio-based, color-gamut-based). **C**
+- Loading hints (lazy, eager). **C**
+- `object-fit` (`contain` / `cover` / `fill` / `none` / `scale-down`), `object-position`. **F**
+- `image-rendering` hints (`auto` / `smooth` / `high-quality` / `crisp-edges` / `pixelated`). **C** — `pixelated` critical for game pixel art.
+- `image-orientation`. **E**
+- Format support driven by Bevy asset pipeline (PNG, JPEG, WebP, AVIF, KTX2, etc.). **F**
+
+**Video / audio** — captioning required (WCAG 1.2.x).
+- Video element (controls, autoplay, muted, loop, poster, preload, playsinline). **E**
+- Audio element. **E**
+- Multiple sources / format negotiation. **E**
+- Captions / subtitles via VTT (track element analogue), WCAG 1.2.2 (Captions, prerecorded — AA). **C**
+- Audio description track support / WCAG 1.2.3 (audio description, prerecorded — A) — slot for descriptive narration track. **C**
+- Live captions / WCAG 1.2.4 — slot for live caption stream. **E**
+- Audio description / WCAG 1.2.5 (AA). **E**
+- Picture-in-picture, fullscreen control. **E**
+
+**Programmatic rendering surfaces**
+- Render-to-texture surfaces (Buiy nodes drawn on a Bevy texture; usable for in-world UI, mini-maps, custom drawing surfaces). **C**
+- Direct integration with Bevy's render targets. **C**
+- 2D drawing context (Canvas2D analogue) — imperative drawing primitive (paths, strokes, fills, gradients, transforms, compositing, text, images, pixel manipulation, hit regions). For custom widgets that paint procedurally without an entity per shape. **C**
+
+**Vector graphics**
+- Vector image rendering (SVG-equivalent) — via lyon or comparable. **C**
+- Inline vector primitives (rect, circle, ellipse, line, polyline, polygon, path, group). **C**
+- Vector filters (feGaussianBlur, feColorMatrix, feMorphology, feTurbulence, feDisplacementMap). **E**
+- External SVG via image asset (rasterized). **C**
+
+**Out:** iframe equivalent (no nested document model), MathML, embedded objects/applets, DRM/EME. **O**
+
+## 3.10 Widget catalog (APG patterns)
+
+Every widget below ships, by default, with: APG keyboard contract, AccessKit role + name source + states, theme-token consumption, `:focus-visible` behavior, forced-colors fallback (no shadow-only affordances), reduced-motion fallback, RTL mirroring, ≥24×24 hit target (WCAG 2.5.8), and coverage by the verification fixture matrix in [verification.md](verification.md) (gates 2 — visual regression, 3 — AccessKit tree snapshot, 4 — announcement output, 7 — APG keyboard contract). Per-widget detail (exact keyboard contract, `aria-haspopup` / `aria-current` value emitted, name source) lives in `buiy-widget-catalog-design`.
+
+**Foundational widgets**
+- Button (incl. toggle button via `aria-pressed`). **F**
+- Link. **F**
+- Text. **F**
+- Image. **F**
+- Heading (with level). **F**
+- Label. **F**
+- Group / Section / Article / Region (semantic containers). **F**
+- Landmarks: banner, navigation, main, complementary, contentinfo, search, region, form. **F**
+
+**Selection & form**
+- Checkbox (binary + tri-state via `aria-checked="mixed"`). **F**
+- Switch. **F**
+- Radio Group. **F**
+- Listbox (single + multi-select). **F**
+- Combobox (textbox + popup listbox). **F**
+- Slider (single + multi-thumb). **F**
+- Spinbutton (numeric stepper). **F**
+- Textbox (single-line + multi-line — see [text.md § 3.5](text.md)). **F**
+- Searchbox. **F**
+- Date picker (calendar grid per APG). **C**
+- Time picker. **C**
+- Color picker. **C**
+- File picker. **C**
+
+**Navigation**
+- Menu. **F**
+- Menubar. **C**
+- Menu Button. **F**
+- Tabs (auto-activate + manual-activate variants). **F**
+- Toolbar. **C**
+- Breadcrumb (uses `aria-current="page"`). **C**
+- Tree. **C**
+- Treegrid. **C**
+
+**Containers & overlays**
+- Dialog (modal + non-modal), with `::backdrop` styling and `closedby` (`any` / `closerequest` / `none`) light-dismiss policy. **F**
+- Alert Dialog. **F**
+- Popover (light dismiss + manual + hint variants), full HTML popover state machine: `auto` (light dismiss + stack), `manual`, `hint`. Invokers via the `command` / `commandfor` analogue. Lifecycle events: `toggle`, `beforetoggle`. **F**
+- Anchored popover — popover + anchor positioning ([visuals.md § 3.2](visuals.md)). **F**
+- Tooltip — non-interactive, hover/focus only, dismissable / hoverable / persistent per WCAG 1.4.13. **F**
+- Disclosure (button + content), uses `::details-content` / `aria-expanded`. **F**
+- Accordion (incl. exclusive accordion via `name` attribute analogue). **F**
+- Window splitter (with keyboard-alternative resize per WCAG 2.5.7). **C**
+- Fullscreen surface — request / exit fullscreen for a Buiy subtree, with `:fullscreen` pseudo-class state, integrated with the top layer. **C**
+- Scrollbar — focusable scrollbar widget per ARIA `scrollbar` role, used standalone (e.g., custom scroll containers); the implicit scrollbars on overflow-scroll are themable but not exposed as widgets. **C**
+
+**Display & feedback**
+- Progressbar (determinate + indeterminate). **F**
+- Meter (with low / high / optimum thresholds). **C**
+- Alert (live region, `role=alert`). **F**
+- Status (live region, `role=status`). **F**
+- Log (live region, `role=log`). **C**
+- Timer (live region, `role=timer`). **C**
+- Toast / Snackbar (live region with auto-dismiss + WCAG 2.2.3 compliance — pause / stop / extend). **F**
+- Carousel — full APG pattern with auto-rotation controls, pause / stop, manual-advance contract, tied to WCAG 2.2.2. **C**
+- Feed (live-loading list, tied to WCAG 2.2.2 pause/stop). **C**
+- Card (composite container; if the entire surface is clickable, exposes `role="button"` or `role="link"` per the canonical "card" pattern; otherwise `role="group"` with internal interactive children). **C**
+- Rating (reuses the APG `slider` pattern with discrete steps; arrow keys increment / decrement, Home / End set min / max). **C**
+
+**Tabular data**
+- Table (semantic). **C**
+- Grid (data grid with cell navigation). **C**
+- Sortable / filterable extensions. **C**
+
+Each widget's APG keyboard contract is enumerated in the per-widget sub-spec (`buiy-widget-catalog-design`).
diff --git a/docs/specs/2026-05-07-buiy-foundation/text.md b/docs/specs/2026-05-07-buiy-foundation/text.md
new file mode 100644
index 0000000..e879694
--- /dev/null
+++ b/docs/specs/2026-05-07-buiy-foundation/text.md
@@ -0,0 +1,113 @@
+# Feature inventory — text
+
+**Parent:** [README.md](README.md)
+
+Tier legend: **F** = foundation, **C** = core, **E** = extended, **O** = out (excluded, with reason). See [README.md § Tier legend](README.md#tier-legend).
+
+## 3.4 Typography
+
+**Font selection**
+- `font-family` with stack + fallback. **F**
+- Generic families (`serif`, `sans-serif`, `monospace`, `cursive`, `fantasy`, `system-ui`, `ui-serif`, `ui-sans-serif`, `ui-monospace`, `ui-rounded`, `emoji`, `math`). **C**
+- `font-size` incl. keyword sizes. **F**
+- `font-weight`. **F**
+- `font-style: normal | italic | oblique <angle>`. **C**
+- `font-stretch` / `font-width`. **C**
+- `font-variant-*` (caps, numeric, ligatures, east-asian, alternates, position, emoji). **C**
+- `font-feature-settings` (raw OpenType). **C**
+- `font-variation-settings` (variable-font axes). **C**
+- `font-optical-sizing`. **E**
+- `font-kerning`. **C**
+- `font-synthesis`. **C**
+- `font-language-override`. **E**
+- `font-size-adjust`. **E**
+- `font-palette` + `@font-palette-values`. **E**
+
+**Variable fonts** — single file, registered axes, smooth interpolation, custom axes. **C**
+
+**Font registration** — Bevy asset-pipeline equivalent of `@font-face`: source, format, unicode-range, font-display strategy. **F**
+- Metric overrides (`size-adjust`, `ascent-override`, `descent-override`, `line-gap-override`) for synthetic-fallback metric matching. **C**
+
+**Inline text layout**
+- `line-height`. **F**
+- `letter-spacing`, `word-spacing`. **C**
+- `text-align: start | end | left | right | center | justify | justify-all | match-parent`. **F**
+- `text-align-last`. **C**
+- `text-justify`. **E**
+- `text-indent`. **C**
+- `vertical-align`. **C**
+- `tab-size`. **C**
+
+**Wrapping & breaking**
+- `white-space` (incl. longhand `white-space-collapse` + `text-wrap: wrap | nowrap | balance | pretty | stable`). **F**
+- `word-break`, `overflow-wrap`, `hyphens`, `line-break`. **C**
+- `hyphenate-character`, `hyphenate-limit-chars`. **E**
+
+**Truncation**
+- `text-overflow: clip | ellipsis | <string>`. **C**
+- Multi-line clamp (`line-clamp`). **C**
+
+**Decoration**
+- `text-decoration-line` / `-color`. **F**
+- `text-decoration-style` (incl. `wavy`) / `-thickness` / `text-underline-offset` / `-position` / `text-decoration-skip-ink`. **C**
+- `text-emphasis-*` (CJK). **E**
+- `text-transform`. **C**
+- `hanging-punctuation`. **E**
+- `text-box-trim` / `text-box-edge` (leading-trim). **E**
+- `text-spacing-trim` (CJK). **E**
+
+**Bidirectional text**
+- Unicode BiDi (UAX #9), implicit. **F**
+- `dir` analogue per text-bearing component. **F**
+- `bdo` / `bdi` analogues, `unicode-bidi`. **C**
+- Vertical orientation (`text-orientation: mixed | upright | sideways`). **E**
+- Ruby annotation primitives. **E**
+
+**Complex script shaping**
+- Arabic joining and cursive forms. **C**
+- Indic syllable formation, reordering, ZWJ/ZWNJ. **C**
+- Thai / Lao / Khmer line break and shaping. **C**
+- CJK punctuation, vertical metrics, full-width/half-width. **C**
+- Emoji, ZWJ sequences, variation selectors (UTS #51). **C**
+
+**Pseudo-elements for text** — see canonical enumeration in [interaction.md § 3.7 Pseudo-elements](interaction.md#37-events-and-input-handling). Cross-references for text-specific pseudo-elements: `::selection` (**F**), `::placeholder` (**F**), `::marker` (**C**), `::first-letter` / `::first-line` (**E**), `::spelling-error` / `::grammar-error` (**E**).
+
+## 3.5 Text editing
+
+**Editor surface**
+- Single-line text input. **F**
+- Multi-line text input. **F**
+- Rich-text edit surface (mixed runs, inline images/links, animated effects). **E**
+- Read-only mode. **F**
+- Disabled mode. **F**
+- Placeholder text. **F**
+
+**Caret & selection**
+- Caret model: logical position + visual position (BiDi-aware). **F**
+- BiDi caret traversal per UAX #9. **F**
+- Selection ranges (single + multi-range). **F**
+- Visual selection rectangles (correct for mixed-direction lines). **F**
+- Caret color / style (token-themed; blink respects reduced-motion). **F**
+- `caret-color`. **F**
+- Auto-scroll-into-view on caret movement / focus. **F**
+
+**IME composition**
+- Composition events (`compositionstart` / `compositionupdate` / `compositionend`) via Bevy's winit IME plumbing. **F**
+- Preedit rendering (underline / highlight). **F**
+- Preedit cursor positioning. **F**
+- Composition commit + undo as a unit. **F**
+- Composition popup positioning. **F**
+
+**Editing operations**
+- Standard editing keys: arrows (with Ctrl for word-nav), Home/End (line + document), PgUp/PgDn, Shift-select, Ctrl-A. **F**
+- Word-segmented navigation per locale. **C**
+- Grapheme-cluster-correct delete. **F**
+- Cut / copy / paste (text + HTML + image MIME). **F**
+- Undo / redo with composition-aware grouping. **F**
+
+**OS integration**
+- Spellcheck (OS where available, software fallback). **C**
+- Autocorrect / autocapitalize. **C**
+- `inputmode` analogue (text / numeric / decimal / tel / email / url / search). **C**
+- `enterkeyhint` analogue. **C**
+- Virtual keyboard show/hide hints. **E**
diff --git a/docs/specs/2026-05-07-buiy-foundation/verification.md b/docs/specs/2026-05-07-buiy-foundation/verification.md
new file mode 100644
index 0000000..15111db
--- /dev/null
+++ b/docs/specs/2026-05-07-buiy-foundation/verification.md
@@ -0,0 +1,80 @@
+# Feature inventory — verification pipeline
+
+**Parent:** [README.md](README.md)
+
+Tier legend: **F** = foundation, **C** = core, **E** = extended, **O** = out (excluded, with reason). See [README.md § Tier legend](README.md#tier-legend).
+
+## 3.15 Verification pipeline
+
+The verification subsystem realizes goal #7 ([README.md § 1](README.md#buiys-goals-the-product)). The inventory below enumerates the floor; detailed strategy (tolerances, baselines, failure thresholds, flake-mitigation, runner choice) lives in `buiy-verification-design`.
+
+The pipeline has two tiers: **CI gates** (every PR; failure blocks merge; no human approval) and **manual release gates** (every release; explicit owner; documented cadence). Goal #7 covers only the CI tier.
+
+### CI gates
+
+| # | Category | Tier | What it verifies | Notes / risk |
+|---|---|---|---|---|
+| 1 | Unit tests | F | Component logic, layout calc, event handlers, state machines. | Standard `cargo test`. |
+| 2 | Visual regression | F | Rendered output matches golden per widget × state × theme × viewport. | **Per-platform goldens** on a single canonical CI GPU class; perceptual diff with explicit tolerance budget; flake-mitigation via fixed clock + font-load sync + atlas warmup. Golden updates require a human-curated `--accept` workflow (intentional changes); CI policy "no approval gate" applies to *test outcomes*, not to golden updates. |
+| 3 | AccessKit tree snapshots | F | Tree shape, role, name, description, states, relationships per widget × state. JSON diff. | `accesskit_consumer`-driven assertions. |
+| 4 | Announcement-output snapshots | C | The string a live region produces; the order of name + role + state utterance for focus changes. Asserted via `accesskit_consumer`'s consumer view. | Independent of tree snapshot — verifies what an AT *would* announce, not the AccessKit tree shape itself. Does not run real NVDA/VoiceOver. |
+| 5 | Layout snapshots | F | Resolved Taffy output per layout fixture (positions, sizes). | |
+| 6 | Synthesized input replay | F | Keyboard, pointer, touch, gamepad events injected as Bevy events; assert resulting state. | IME composition is verified at the Buiy↔winit boundary only; full OS-IME conformance (IBus, fcitx, TSF, macOS IM) is in the manual release gate. |
+| 7 | APG keyboard-contract conformance | F | Every APG pattern, every documented key, every state transition. Forms-mode and browse-mode contracts both exercised via `accesskit_consumer`. | Verifies key-to-state mapping; the *AT utterance* on each transition is in #4. |
+| 8 | WCAG 2.2 SC suite (machine-testable) | F | Each Level A / AA SC marked **CI** in the [accessibility.md § 3.11 table](accessibility.md). | SCs marked **DC** / **LR** are explicitly NOT CI gates. Content-quality SCs (1.1.1 alt-text quality, 1.4.5, 2.4.4, 2.4.6, 3.3.2) are linter-with-review or design-constraint, not CI. |
+| 9 | Contrast linter | F | Every theme × every token combination. WCAG 2 (4.5:1 / 3:1 / 3:1) is the gate; APCA (Lc thresholds: ~Lc 60 minimum, Lc 75 body, Lc 90 preferred) is advisory. | Both algorithms ship; WCAG 2 is the legal-bar gate. APCA upgrade path documented in `buiy-verification-design`. |
+| 10 | Hit-target linter | F | Every interactive widget rendered with hit area ≥24×24 at every viewport in the fixture set. | Geometric check on the picking hit-rect at layout time. |
+| 11 | Forced-colors compatibility scan | F | Two checks: (a) no widget paints a color outside the system-color token set when `forced-colors: active`; (b) no shadow-only affordance — every focusable / state-bearing widget has a non-shadow visual cue (border, fill, outline). | Token-flow analyzer + golden visual diff under forced-colors. |
+| 12 | Property tests / fuzzing | F | Generators for hierarchies (max-depth N, max-breadth M, shrink-to-minimal-failing-tree), input streams, theme-variant matrices. Invariants: "focus tree reachable from any starting node," "AccessKit tree has no orphans," "every focusable node has an accessible name," "BiDi caret round-trip equals identity." | `proptest` with named strategies. |
+| 13 | Hot-reload validation | F | Reload `.bsn` file or theme asset; assert live entity diff over stable IDs equals expected diff; no entity / atlas leaks. | Equality predicate is "stable-ID-keyed entity-state diff"; spec'd in `buiy-verification-design`. |
+| 14 | Performance regression | F | Per-frame layout time + render time + AccessKit-update time relative to main-branch baseline on a fixed self-hosted runner. | The CI gate's *mechanism* (relative-to-main, fixed runner, ±10% default slack) is committed. The *actual budget numbers* per fixture are an open question ([README.md § 5](README.md#5-open-questions)) owned by `buiy-verification-design`. The gate exists at v1; the numbers calibrate over time. |
+| 15 | Memory leak tests | F | RSS slope and atlas-entry count return to baseline after a defined long-running fixture (~10 minutes of scripted activity, then idle). | Threshold: RSS slope < 1 MB / minute after warmup; atlas entries return within ε of baseline. |
+
+### CI platform matrix
+
+- **Desktop (Windows UIA, macOS NSAccessibility, Linux AT-SPI)** — full CI matrix for v1, all categories above.
+- **Android** — deferred until `accesskit_android` exposes a headless harness; until then, manual release-gate platform.
+- **iOS** — deferred until `accesskit_ios` ships and a CI strategy (Mac runner + simulator, or device farm) is selected; until then, manual release-gate platform.
+- **Web** — deferred until AccessKit web adapter ships; until then, no a11y verification on web target.
+
+Open question on platform staging: [README.md § 5](README.md#5-open-questions).
+
+### CI policy
+
+- Runs on every PR. Failure blocks merge.
+- "No human approval gate" applies to **test outcomes**: green = mergeable. Golden-image and AccessKit-snapshot updates use a human-reviewed `--accept` workflow as part of standard PR review.
+- Cross-platform matrix runs in parallel.
+
+### Manual release gates (NOT CI gates; required at every release)
+
+These gate releases, not PRs. Each has an owner, a documented cadence, and a release-blocking sign-off mechanism: each gate produces a checked-in sign-off document at `docs/release-notes/<version>/manual-gate-<gate>-signoff.md`. Tagging a release is gated on all four sign-off documents being present and approved on the release branch.
+
+1. **Real-SR output sanity sweep** — run a curated fixture suite under NVDA + Firefox-equivalent host (Windows), VoiceOver (macOS), Orca (Linux GNOME), TalkBack (Android emulator). Verify utterances against expected-output strings. Owner: a11y maintainer. Cadence: every minor release. (May graduate to a CI gate if a headless real-SR harness becomes practical — open question.)
+2. **Real-device mobile sweep** — Android + iOS on physical or simulated devices; verify TalkBack / VoiceOver behavior, IME composition with real OS IMEs (IBus, fcitx, macOS Japanese IM, Windows TSF), gesture recognizers under real touch. Owner: platform maintainer. Cadence: every minor release.
+3. **Subjective visual review** — design lead reviews default theme(s), widget gallery, animation polish. Cadence: every minor release. Note: WCAG 1.4.3 / 1.4.11 contrast is *not* in this gate (it's CI #9); this gate covers polish and brand alignment.
+4. **Content-quality SC review** — alt-text quality, link-purpose, label clarity in shipping examples and docs. WCAG 1.1.1 / 1.4.5 / 2.4.4 / 2.4.6 / 3.3.2. Owner: docs maintainer. Cadence: every minor release.
+
+**Coverage tradeoff acknowledgment (cross-reference [README.md § 1](README.md#buiys-goals-the-product)):** these four gates collectively cover real-AT speech, real-device behavior, subjective polish, and content quality. Several user-experience claims sit at the manual tier rather than the CI tier. Goal #7 is honest about this — "every machine-testable claim" — but readers should understand that "Buiy's verification pipeline is fully automated" only refers to the CI tier, not to all things end-users experience.
+
+### Multi-window verification
+
+All CI gates run per-window where applicable. AccessKit tree snapshots, focus tree state, IME consumer state, and picking results are keyed by `WindowId`. Multi-window fixtures verify per-window stack ownership ([cross-cutting.md § 3.18](cross-cutting.md)).
+
+### Hot-reload trigger flow
+
+Asset hot-reload tests (gate #13) drive the verification harness through Bevy's standard `AssetEvent::Modified` for `BsnAsset`, `ThemeAsset`, and `FontAsset`. Buiy's reload systems observe these events and apply the diff; the harness then asserts the post-reload entity-state diff equals the expected diff. Asset graph and `AssetServer` integration is owned by `buiy-asset-pipeline-design`.
+
+### Tooling
+
+- `accesskit_consumer` — simulated AT consumer for tree-snapshot and announcement-snapshot testing.
+- Bevy's screenshot system + a perceptual-diff crate — visual regression with tolerance budget.
+- `proptest` — property-based testing.
+- `buiy_verify` — Buiy's own harness crate; `dev-dependency` for every Buiy crate; usable by downstream Buiy users to test their own widgets.
+
+### What is *not* a CI gate (and why)
+
+- **Real-SR utterance verification.** `accesskit_consumer` simulates the consumer side; it does not run NVDA / JAWS / VoiceOver. Manual release gate (#1 above). Goal #7 explicitly excludes this from "machine-testable claims."
+- **Full OS-IME conformance.** OS IME backends sit upstream of winit; we verify Buiy↔winit at the boundary, real OS IME at release time.
+- **WCAG content-quality SCs** (1.1.1, 1.4.5, 2.4.4, 2.4.6, 3.3.2). Linter advises; humans confirm.
+- **Subjective visual quality.** Manual release gate.
+- **Real-device mobile / web a11y.** Pending platform staging ([README.md § 5](README.md#5-open-questions)).
diff --git a/docs/specs/2026-05-07-buiy-foundation/visuals.md b/docs/specs/2026-05-07-buiy-foundation/visuals.md
new file mode 100644
index 0000000..86007f8
--- /dev/null
+++ b/docs/specs/2026-05-07-buiy-foundation/visuals.md
@@ -0,0 +1,171 @@
+# Feature inventory — visuals
+
+**Parent:** [README.md](README.md)
+
+Tier legend: **F** = foundation, **C** = core, **E** = extended, **O** = out (excluded, with reason). See [README.md § Tier legend](README.md#tier-legend).
+
+## 3.1 Document model and component hierarchy
+
+- Element/node tree (entity hierarchy with parent/child/sibling). **F**
+- Document order (canonical traversal; default tab order; AccessKit tree order). **F**
+- Range and selection model (text ranges spanning nodes, multi-range, programmatic). **C**
+- Mutation primitives (Bevy observers + change detection; widget-level `OnMutate` / `OnInsert`). **C**
+- Tree walker / filtered traversal (skip inert / hidden / disabled). **C**
+- Semantic role categories: landmarks, document structure, sectioning, phrasing, edit annotations, embedded content, tabular, interactive — every category has a Buiy primitive. **F**
+- Replaced elements (image, video, canvas, embedded surfaces) — different sizing rules, intrinsic dimensions, `object-fit`. **C**
+- Component encapsulation (subtree boundaries via marker components — Shadow-DOM analogue). **E**
+- User-defined components, same primitives as built-ins. **F**
+- Slot / projection (Bevy's `children!` macro). **C**
+- Focus tree — first-class subsystem; ordered, filterable, partitionable. **F**
+- `tabindex` analogue (`Auto`, `Skip`, `Order(i32)`). **F**
+- `inert` subtree (removes from focus + AccessKit + hit-testing). **F**
+- **Out:** HTML parser, document streaming, `<head>` metadata, document.title beyond window title, `<base>`. **O**
+
+## 3.2 Layout
+
+Powered by Taffy directly. Buiy extends Taffy where Taffy doesn't yet cover something needed.
+
+**Box model**
+- Content / padding / border / margin boxes; `box-sizing` analogue. **F**
+- Margin collapse (block flow). **C**
+- `min/max/width/height` with `min-content` / `max-content` / `fit-content` / `auto` / `stretch`. **C**
+- `aspect-ratio`. **C**
+- Logical properties (`inline-size`, `block-size`, `padding-inline-*`, `margin-block-*`, `border-inline-*`). **F**
+
+**Display modes**
+- Block, inline, inline-block. **F**
+- Flex / inline-flex (full Flexbox). **F**
+- Grid / inline-grid (full CSS Grid). **F**
+- `flow-root`. **C**
+- `contents`. **E**
+- `none`. **F**
+- Table, table-row-group, table-row, table-cell, table-caption (semantic table layout for data). **C**
+- `list-item`. **E**
+- Ruby (CJK furigana). **E**
+
+**Positioning**
+- `static`, `relative`, `absolute`, `fixed`, `sticky`. **F**
+- Containing-block resolution. **F**
+- `inset` shorthand + logical `inset-block-*` / `inset-inline-*`. **F**
+- Anchor positioning (`anchor-name`, `position-anchor`, `anchor()`, `anchor-size()`, `position-try`, `@position-try`). **C**
+
+**Flexbox** — full spec via Taffy. **F**
+
+**Grid** — full CSS Grid via Taffy. **F**
+- Subgrid — Taffy roadmap; we ship when Taffy ships. **C**
+- Masonry — flux. **E**
+
+**Multi-column** (`column-count`, `column-width`, `column-gap`, `column-rule`, `column-span`, `break-*`). **E**
+
+**Float / clear** — legacy. **O**
+- `shape-outside`, `shape-margin`. **O**
+
+**Container queries** (`@container`, `container-type`, `container-name`, `cqw/cqh/cqi/cqb` units). **C**
+
+**Scroll-driven animations** (`animation-timeline`, `scroll-timeline`, `view-timeline`). **E**
+
+**Writing modes & direction**
+- `writing-mode`: horizontal-tb, vertical-rl, vertical-lr, sideways-rl, sideways-lr. **C**
+- `direction`: ltr / rtl. **F**
+- `text-orientation`. **E**
+- `unicode-bidi`. **C**
+
+**Overflow & scrolling**
+- `overflow: visible | hidden | clip | scroll | auto`, axis variants, logical (`overflow-block` / `overflow-inline`). **F**
+- `scroll-behavior: smooth | auto`. **C**
+- `overscroll-behavior`. **C**
+- Scroll snap (`scroll-snap-type`, `scroll-snap-align`, `scroll-snap-stop`, `scroll-padding`, `scroll-margin`). **C**
+- `scrollbar-gutter`, `scrollbar-color`, `scrollbar-width`. **C**
+
+**Stacking & paint**
+- Stacking contexts (positioned + z-index, opacity < 1, transform, filter, will-change, isolation, mix-blend-mode). **F**
+- `z-index`. **F**
+- `isolation`. **C**
+- True top layer for modals / popovers / dialogs / fullscreen. **F**
+
+**Units**
+- `px`. **F**
+- Print units (`cm`, `mm`, `in`, `pt`, `pc`, `Q`). **O**
+- Font-relative (`em`, `rem`). **F**; (`ch`, `lh`, `rlh`, `cap`, `ic`, `ex`). **C**
+- Viewport (`vw`, `vh`, `vmin`, `vmax`, plus small / large / dynamic variants). **C**
+- Container (`cqw`, `cqh`, `cqi`, `cqb`, `cqmin`, `cqmax`). **C**
+- Percentages. **F**
+- `fr` (grid). **F**
+- Angles (`deg`, `rad`, `grad`, `turn`). **C**
+- Time (`s`, `ms`). **C**
+- Frequency (`Hz`, `kHz`). **E**
+- Resolution (`dpi`, `dppx`). **C**
+
+**Transforms & containment**
+- `transform`, `transform-origin`, 2D + 3D, `transform-style`, `perspective`, `backface-visibility`. **C**
+- Standalone `translate` / `rotate` / `scale`. **C**
+- `will-change`. **E**
+- `contain` (layout / paint / size / style / inline-size / content / strict). **C**
+- `content-visibility` (visible / auto / hidden) for off-screen lazy rendering. **C**
+
+## 3.3 Visual styling and rendering
+
+**Color**
+- Named colors, `transparent`, `currentColor`. **F**
+- `rgb()` / `rgba()` / `hsl()` / `hsla()` / `hwb()`. **F**
+- `lab()`, `lch()`, `oklab()`, `oklch()`. **C**
+- `color()` with profiles (sRGB linear, display-p3, rec2020, a98-rgb, prophoto-rgb, xyz). **C**
+- `color-mix(in <space>, c1 p1, c2 p2)`. **C**
+- Relative color syntax. **E**
+- System color keywords (`Canvas`, `CanvasText`, `LinkText`, `ButtonText`, `ButtonBorder`, `GrayText`, `Highlight`, `HighlightText`, `Field`, `FieldText`, `Mark`, `MarkText`, `SelectedItem`, `SelectedItemText`, `AccentColor`, `AccentColorText`) for forced-colors. **F**
+- `color-scheme` property — opt a subtree into light / dark / both for native widget rendering hints (distinct from the `prefers-color-scheme` media query). **C**
+- `forced-color-adjust` — per-element opt-out of forced-colors mode (`auto` / `none` / `preserve-parent-color`). **C**
+
+**Backgrounds**
+- `background-color`. **F**
+- `background-image` (URL + gradients). **C**
+- Gradients: linear, radial, conic, repeating variants; color stops, hints, color-space interpolation. **C**
+- Multiple background layers. **C**
+- `background-position` / `-size` / `-repeat` / `-attachment` / `-origin` / `-clip` (incl. `text`) / `-blend-mode`. **C**
+- `image-set()`. **E**
+
+**Borders**
+- `border-width` / `-style` / `-color`, longhands per side, logical. **F**
+- `border-radius` incl. elliptical per-corner. **F**
+- `border-image`. **E**
+
+**Shadows, filters, effects** (full set achievable because we own the renderer)
+- `box-shadow`, multiple, inset, spread. **F**
+- `text-shadow`. **C**
+- `filter`: blur, brightness, contrast, drop-shadow, grayscale, hue-rotate, invert, opacity, saturate, sepia. **C**
+- `backdrop-filter`. **C**
+- `mix-blend-mode` + `background-blend-mode`, full blend mode set. **C**
+- `isolation`. **C**
+- `clip-path`: `inset()`, `circle()`, `ellipse()`, `polygon()`, `path()`, `xywh()`, `rect()`, geometry-box keywords. **C**
+- `mask` family (`mask-image`, `-mode`, `-position`, `-size`, `-repeat`, `-origin`, `-clip`, `-composite`). **C**
+- `opacity`. **F**
+- `visibility: visible | hidden | collapse`. **F**
+
+**Outline & focus indicators**
+- `outline-color` / `-style` / `-width` / `-offset`. **F**
+- `accent-color`. **C**
+- `caret-color`. **C**
+
+**Cursor & pointer behavior**
+- `cursor` — full keyword set. **C**
+- Custom cursor (image + hotspot, fallback). **E**
+- `pointer-events` (`auto` / `none`). **F**
+- `user-select` (auto / none / text / all / contain). **F**
+- `touch-action`. **C**
+
+**Custom properties + value functions**
+- Buiy tokens are the canonical "CSS variables." Typed and themable. **F**
+- `calc()` / `min()` / `max()` / `clamp()` analogues for sizes & numbers. **F**
+- Math (`mod()`, `rem()`, `round()`, `abs()`, `sign()`, `pow()`, `sqrt()`, trig). **C**
+- `env()` analogue (UA values: safe-area, system-color slots, OS prefs). **C**
+- Typed custom props. **E**
+
+**Render pipeline features (Buiy-owned)**
+- Per-element clipping with arbitrary shapes. **F**
+- Per-element filters and blend modes composed correctly with parent stacking context. **C**
+- Backdrop sampling for `backdrop-filter`. **C**
+- Top-layer compositing. **F**
+- Texture atlases for glyphs, icons, gradients, generated masks. **F**
+- Render-to-texture surfaces (UI as a texture for in-world / 3D-anchored use). **C**
+- HDR rendering pass when display supports it. **E**
+- Color management (linear-light render, sRGB / display-p3 / rec2020 output when display advertises). **C**
diff --git a/examples/hello_button/Cargo.toml b/examples/hello_button/Cargo.toml
new file mode 100644
index 0000000..55259da
--- /dev/null
+++ b/examples/hello_button/Cargo.toml
@@ -0,0 +1,12 @@
+[package]
+name = "hello_button"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+repository.workspace = true
+rust-version.workspace = true
+publish = false
+
+[dependencies]
+bevy = { workspace = true, features = ["bevy_render", "bevy_winit", "x11", "wayland"] }
+buiy = { path = "../../crates/buiy" }
diff --git a/examples/hello_button/src/main.rs b/examples/hello_button/src/main.rs
new file mode 100644
index 0000000..00ebcba
--- /dev/null
+++ b/examples/hello_button/src/main.rs
@@ -0,0 +1,30 @@
+//! Buiy Phase 0 hello-world: spawn one Button. The end-to-end verification
+//! test (`tests/hello_button_e2e.rs`) drives the same scene and asserts
+//! visual regression + AccessKit tree snapshot + focus / click behavior.
+//!
+//! Bevy 0.18 split buffered events into `Message`. `OnPress` is therefore a
+//! `Message`, not an `Event` — read with `MessageReader` instead of
+//! `EventReader`. See `buiy_widgets::button` for the producer side.
+
+use bevy::prelude::*;
+use buiy::*;
+
+fn main() {
+    App::new()
+        .add_plugins(DefaultPlugins)
+        .add_plugins(BuiyPlugin)
+        .add_systems(Startup, setup)
+        .add_systems(Update, log_press)
+        .run();
+}
+
+fn setup(mut commands: Commands) {
+    commands.spawn(Camera2d);
+    commands.spawn(Button::new("Save"));
+}
+
+fn log_press(mut events: MessageReader<OnPress>) {
+    for ev in events.read() {
+        info!("button pressed: {:?}", ev.0);
+    }
+}
diff --git a/rust-toolchain.toml b/rust-toolchain.toml
new file mode 100644
index 0000000..73cb934
--- /dev/null
+++ b/rust-toolchain.toml
@@ -0,0 +1,3 @@
+[toolchain]
+channel = "stable"
+components = ["rustfmt", "clippy"]
diff --git a/rustfmt.toml b/rustfmt.toml
new file mode 100644
index 0000000..9fbe390
--- /dev/null
+++ b/rustfmt.toml
@@ -0,0 +1,5 @@
+edition = "2024"
+# imports_granularity = "Module" and group_imports = "StdExternalCrate" are
+# nightly-only as of rustfmt 1.x on stable. Re-enable when the project moves
+# fmt to nightly (see open question in docs/plans/2026-05-07-buiy-phase-0-foundations.md
+# and follow-ups).
diff --git a/src/lib.rs b/src/lib.rs
new file mode 100644
index 0000000..1526f90
--- /dev/null
+++ b/src/lib.rs
@@ -0,0 +1,3 @@
+//! Workspace root crate. Exists only to host the workspace-level smoke test
+//! at `tests/workspace_smoke.rs`. No production code lives here; per-crate
+//! code lives under `crates/`.
diff --git a/tests/fixtures/hello_button/golden_a11y_tree.json b/tests/fixtures/hello_button/golden_a11y_tree.json
new file mode 100644
index 0000000..50fa087
--- /dev/null
+++ b/tests/fixtures/hello_button/golden_a11y_tree.json
@@ -0,0 +1 @@
+[{"entity":0,"role":"Button","name":"Save","description":"","focusable":true}]
\ No newline at end of file
diff --git a/tests/hello_button_e2e.rs b/tests/hello_button_e2e.rs
new file mode 100644
index 0000000..79774f9
--- /dev/null
+++ b/tests/hello_button_e2e.rs
@@ -0,0 +1,120 @@
+//! Phase 0 end-to-end verification fixture. Exercises the full Buiy
+//! pipeline against the hello_button example scene:
+//!  - layout resolves
+//!  - render pipeline plugin loads (no panic on app.update())
+//!  - AccessKit tree snapshot matches golden
+//!  - Tab focuses the Button (FocusVisible = true)
+//!
+//! Coverage NOT in this file:
+//! - Visual regression (CI gate #2): requires a wgpu adapter; covered by
+//!   `crates/buiy_verify/tests/visual.rs` for the diff primitive and by
+//!   the (currently `#[ignore]`d) `pipeline_registers_in_render_app` test
+//!   in `crates/buiy_core/tests/render_smoke.rs`. Real screenshot e2e
+//!   lands when CI runners with lavapipe / a real GPU come online.
+//! - Click → OnPress: covered in `crates/buiy_widgets/tests/button.rs`.
+//!   Driving a real click here would need synthetic pointer events;
+//!   v0.x work per `buiy-input-events-design`.
+//! - Contrast linter: covered in `crates/buiy_verify/tests/contrast.rs`
+//!   (`lint_theme_passes_for_default_light`). Not duplicated here.
+
+use bevy::prelude::*;
+use buiy::*;
+use buiy_verify::a11y::{diff_snapshots, snapshot_tree};
+
+fn setup_scene(app: &mut App) {
+    // BuiyPlugin reads `ButtonInput<KeyCode>` + `ButtonInput<MouseButton>`;
+    // init the resources directly instead of pulling in InputPlugin so the
+    // PreUpdate clear-system doesn't wipe test-driven presses before
+    // `handle_tab` runs in `BuiySet::Input`.
+    app.add_plugins(MinimalPlugins);
+    app.init_resource::<ButtonInput<KeyCode>>();
+    app.init_resource::<ButtonInput<MouseButton>>();
+    app.add_plugins(BuiyPlugin);
+    app.world_mut().spawn(Button::new("Save"));
+}
+
+fn press_tab(app: &mut App) {
+    {
+        let mut keys = app.world_mut().resource_mut::<ButtonInput<KeyCode>>();
+        keys.release_all();
+        keys.clear();
+        keys.press(KeyCode::Tab);
+    }
+    app.update();
+}
+
+#[test]
+fn e2e_layout_and_a11y_tree_match_golden() {
+    let mut app = App::new();
+    setup_scene(&mut app);
+    app.update();
+
+    let builder = app.world().resource::<A11yTreeBuilder>();
+    let snap = snapshot_tree(builder.snapshot());
+
+    let golden = std::fs::read_to_string("tests/fixtures/hello_button/golden_a11y_tree.json")
+        .expect("golden file present");
+    let golden = canonicalize_entity_ids(&golden);
+    let snap = canonicalize_entity_ids(&snap);
+
+    assert!(
+        diff_snapshots(&snap, &golden).is_none(),
+        "AccessKit tree drift; expected = {golden}, actual = {snap}"
+    );
+}
+
+#[test]
+fn e2e_tab_focuses_button() {
+    let mut app = App::new();
+    setup_scene(&mut app);
+    app.update();
+    press_tab(&mut app);
+    let focused = app.world().resource::<FocusedEntity>().0;
+    assert!(focused.is_some(), "Tab focuses the Button");
+    assert!(
+        app.world().resource::<FocusVisible>().0,
+        "focus-visible is set after Tab (keyboard-driven focus)"
+    );
+}
+
+/// Replace entity-bit fields with a stable placeholder so goldens don't
+/// drift across test runs (entities are allocated dynamically).
+///
+/// LINT: Naive scanner. Assumes `"entity"` values in the snapshot are
+/// scalars (currently `u64` per `buiy_verify::a11y::WireNode`). Nested
+/// objects or strings containing `,`/`}` would corrupt the output. If
+/// the wire format ever grows non-scalar entity values, replace this
+/// with a `serde_json::Value` round-trip.
+fn canonicalize_entity_ids(s: &str) -> String {
+    let mut out = String::with_capacity(s.len());
+    let mut chars = s.chars().peekable();
+    while let Some(c) = chars.next() {
+        if c == '"' {
+            // Look for "entity":N pattern.
+            let mut buf = String::from(c);
+            while let Some(&n) = chars.peek() {
+                if n == '"' {
+                    buf.push(chars.next().unwrap());
+                    break;
+                }
+                buf.push(chars.next().unwrap());
+            }
+            if buf == "\"entity\"" {
+                out.push_str(&buf);
+                // Skip until comma or }, replacing the value.
+                while let Some(&n) = chars.peek() {
+                    if n == ',' || n == '}' {
+                        break;
+                    }
+                    chars.next();
+                }
+                out.push_str(":0");
+            } else {
+                out.push_str(&buf);
+            }
+        } else {
+            out.push(c);
+        }
+    }
+    out
+}
diff --git a/tests/workspace_smoke.rs b/tests/workspace_smoke.rs
new file mode 100644
index 0000000..1885713
--- /dev/null
+++ b/tests/workspace_smoke.rs
@@ -0,0 +1,5 @@
+#[test]
+fn workspace_builds() {
+    // This is a compile-time assertion that the workspace is well-formed.
+    // If this file compiles, the workspace is valid.
+}