15-question review gate

Every string that is really a finite set (states, labels, error kinds, allowlists, lanes, list markers) is an enum with exhaustive switches; CaseIterable where tests should iterate.

No hand-built JSON string literals in production code. Error frames, DTOs, and happy-path fixtures encode from types. Byte-equality where wire shape matters. macOS 26 JSONEncoder randomizes key order per-process — stable bytes need a canonical writer (Exhibit 13).

Function vs computed property — honest about cost. Prefer switch over chained ifs; guard let for early exit, if let for local branch, for case let for filtered pattern-matching.

Protocols only where implementations genuinely vary. Finite variation = enum, not a protocol hierarchy.

map/compactMap/flatMap/reduce when the source is a collection and the transform is pure. Keep streaming loops when collecting would allocate, delay results, or hide side effects.

Shared mutable state is actor-isolated or value-typed Sendable. Every @unchecked Sendable carries a written justification. Cross-boundary values conform to Sendable.

Value, one-shot async function, or AsyncSequence? Choose the smallest model that represents the real lifetime. Combine only at real publisher boundaries.

Each meaningful branch emits a typed event with a glyph through one enum surface. A new decision point without an event fails the gate.

No ambient environment inheritance. Auth before privileged side effects. No PII in logs. Brokered secrets, never embedded. App Control /state never dumps Keychain.

Every new UI state covered: loading / empty / error / long content / Dynamic Type / dark mode. Preview-parity suites where the repo has them.

Layout/rendering regressions that matter have snapshots — baselines are CI-recorded, never studio-recorded. A green suite against a void baseline proves nothing (Exhibit 7).

Intentional haptics for meaningful taps; a11y labels; identifiers for control vs labels for humans. No fake live states.

Hot path allocation-conscious. No sync work on the main/timeline thread. No accidental O(n²).

CaseIterable drives tests. Behavioral changes carry a rendered sequence/flow diagram; UI changes carry a snapshot gallery. E2E paths proven by running them — receipts posted, not vibes.

Is there a simpler API — fewer types, less indirection — that still keeps Q1–Q14? If not, say why in the PR.