diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 0f98e42..4041ad5 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -6,7 +6,7 @@ Get it running first, so you know the environment is sound:
 
 ```bash
 npm install
-npm test        # 347 of them, ~1.5s, no network
+npm test        # 362 of them, ~1.5s, no network
 npm run dev     # demo mode; no keys needed
 ```
 
diff --git a/README.md b/README.md
index ea9a391..0bb2a6b 100644
--- a/README.md
+++ b/README.md
@@ -336,12 +336,12 @@ The audit needs a running server and `npx playwright install chromium`, so it st
 
 
 ```bash
-npm test          # 347 of them, ~1.5s, no network
+npm test          # 362 of them, ~1.5s, no network
 ```
 
 They cover **the three rules taken back from the model** — selling-point count decides grid vs list, tier count decides single vs comparison, whether there is a UI screenshot decides the hero layout. If any of these drift, the decision quietly goes back to a model that cannot make it, so they are the ones that must not move.
 
-Also covered: readiness gating (an empty array counts as missing, not ready), `asSettled` completion ordering, and the JSX serializer's sharp edges — custom properties need `as CSSProperties`, semicolons inside a gradient are not separators, text containing braces must be wrapped, and the `blk-in` animation class and `<style>` block must not reach the export. The agent-facing surfaces get the same treatment: `bundle.zip` is read back by a second, deliberately slow zip reader written in the test file rather than by the writer that produced it, `/llms.txt` is parsed against the llmstxt.org shape and checked line by line against the real block, theme and source tables, and the MCP server is driven through the handshake, every tool it advertises, and a series of messages that arrive broken.
+Also covered: the catalog contract, now enforced rather than declared — a block whose props do not satisfy the schema `lib/catalog.ts` states for it holds its place as a skeleton instead of reaching a renderer that casts; readiness gating (an empty array counts as missing, not ready), `asSettled` completion ordering, and the JSX serializer's sharp edges — custom properties need `as CSSProperties`, semicolons inside a gradient are not separators, text containing braces must be wrapped, and the `blk-in` animation class and `<style>` block must not reach the export. The agent-facing surfaces get the same treatment: `bundle.zip` is read back by a second, deliberately slow zip reader written in the test file rather than by the writer that produced it, `/llms.txt` is parsed against the llmstxt.org shape and checked line by line against the real block, theme and source tables, and the MCP server is driven through the handshake, every tool it advertises, and a series of messages that arrive broken.
 
 Plus structural invariants: every slot an archetype references must exist, required and optional must not overlap, `SLOT_ORDER` must cover every slot exactly once, and every variant must declare the fields it needs.
 
diff --git a/app/page.tsx b/app/page.tsx
index b0c0dda..c785871 100644
--- a/app/page.tsx
+++ b/app/page.tsx
@@ -5,6 +5,7 @@ import { JSONUIProvider, Renderer } from "@json-render/react";
 import type { Spec } from "@json-render/core";
 import { registry } from "./registry";
 import { THEMES } from "@/lib/themes";
+import { validateProps } from "@/lib/catalog";
 import { elementsFor, type SiteContent } from "@/lib/content";
 import { isReady } from "@/lib/content-parallel";
 import { layoutRules, SLOTS, SLOT_ORDER, type SlotKey } from "@/lib/plan";
@@ -241,6 +242,12 @@ export default function Page() {
       }
       const element = elementsFor(content)[plan.variant];
       if (!element) return;
+      // compose.ts checks every element against its catalog schema before the spec leaves the server, and these two branches splice past that: the element is assembled here, from content this client happens to be holding. isReady above says the fields are there; only the catalog says they are the right shape. A restyle onto a variant the copy cannot fill is the same non-event either way, and saying so beats swapping in a block whose props the renderer will cast rather than check.
+      const problem = validateProps(element.type, element.props ?? {});
+      if (problem) {
+        setEditLog((log) => [...log, `  ${t.notReady}`]);
+        return;
+      }
       setVariants((current) => ({ ...current, [plan.slot]: plan.variant }));
       setSpec((current) => {
         if (!current) return current;
@@ -269,7 +276,7 @@ export default function Page() {
         return;
       }
       const element = elementsFor(content)[id as keyof ReturnType<typeof elementsFor>];
-      if (!element) {
+      if (!element || validateProps(element.type, element.props ?? {})) {
         setEditLog((log) => [...log, `  ${t.notReady}`]);
         return;
       }
diff --git a/docs/CONTRIBUTING.zh.md b/docs/CONTRIBUTING.zh.md
index edf3bf4..5249e2f 100644
--- a/docs/CONTRIBUTING.zh.md
+++ b/docs/CONTRIBUTING.zh.md
@@ -6,7 +6,7 @@
 
 ```bash
 npm install
-npm test                     # 347 个，约 1.5 秒，不碰网络
+npm test                     # 362 个，约 1.5 秒，不碰网络
 npm run dev                  # 演示模式，不需要 key
 ```
 
diff --git a/docs/README.de.md b/docs/README.de.md
index fe377cf..4bb8563 100644
--- a/docs/README.de.md
+++ b/docs/README.de.md
@@ -333,12 +333,12 @@ Die Prüfung braucht einen laufenden Server und `npx playwright install chromium
 
 
 ```bash
-npm test          # 347 Stück, rund 1,5 s, ohne Netz
+npm test          # 362 Stück, rund 1,5 s, ohne Netz
 ```
 
 Sie decken **die drei dem Modell abgenommenen Regeln** ab: Die Anzahl der Verkaufsargumente entscheidet Raster oder Liste, die Anzahl der Preisstufen entscheidet Einzelkarte oder Vergleich, und ob es einen Oberflächen-Screenshot gibt, entscheidet das Layout des Kopfbereichs. Driftet eine davon, geht die Entscheidung still an ein Modell zurück, das sie nicht treffen kann — sie dürfen sich also nicht bewegen.
 
-Ebenfalls abgedeckt: die Freigabe nach Datenlage (ein leeres Array zählt als fehlend, nicht als bereit), die Abschlussreihenfolge von `asSettled` und die Kanten des JSX-Serialisierers — Custom Properties brauchen `as CSSProperties`, Semikolons in einem Farbverlauf sind keine Trennzeichen, Text mit geschweiften Klammern muss eingefasst werden, und weder die Animationsklasse `blk-in` noch der `<style>`-Block dürfen in den Export gelangen. Die an Agenten gerichteten Oberflächen bekommen dieselbe Behandlung: `bundle.zip` wird von einem zweiten, bewusst langsamen Zip-Leser zurückgelesen, der in der Testdatei steht und nicht von dem Schreiber, der es erzeugt hat; `/llms.txt` wird gegen die Form von llmstxt.org geparst und Zeile für Zeile mit den echten Block-, Theme- und Quellentabellen abgeglichen; und der MCP-Server wird durch den Handshake, durch jedes Werkzeug, das er ankündigt, und durch eine Reihe kaputt eintreffender Nachrichten geführt.
+Ebenfalls abgedeckt: der Vertrag des Katalogs, jetzt durchgesetzt statt bloß erklärt — ein Block, dessen Props das Schema nicht erfüllen, das `lib/catalog.ts` für ihn festlegt, hält seinen Platz als Skelett, statt bei einem Renderer zu landen, der nur castet; die Freigabe nach Datenlage (ein leeres Array zählt als fehlend, nicht als bereit), die Abschlussreihenfolge von `asSettled` und die Kanten des JSX-Serialisierers — Custom Properties brauchen `as CSSProperties`, Semikolons in einem Farbverlauf sind keine Trennzeichen, Text mit geschweiften Klammern muss eingefasst werden, und weder die Animationsklasse `blk-in` noch der `<style>`-Block dürfen in den Export gelangen. Die an Agenten gerichteten Oberflächen bekommen dieselbe Behandlung: `bundle.zip` wird von einem zweiten, bewusst langsamen Zip-Leser zurückgelesen, der in der Testdatei steht und nicht von dem Schreiber, der es erzeugt hat; `/llms.txt` wird gegen die Form von llmstxt.org geparst und Zeile für Zeile mit den echten Block-, Theme- und Quellentabellen abgeglichen; und der MCP-Server wird durch den Handshake, durch jedes Werkzeug, das er ankündigt, und durch eine Reihe kaputt eintreffender Nachrichten geführt.
 
 Dazu strukturelle Invarianten: Jeder von einem Archetyp referenzierte Slot muss existieren, Pflicht und Optional dürfen sich nicht überschneiden, `SLOT_ORDER` muss jeden Slot genau einmal abdecken, und jede Variante muss die Felder deklarieren, die sie braucht.
 
diff --git a/docs/README.es.md b/docs/README.es.md
index 11fb325..716e55e 100644
--- a/docs/README.es.md
+++ b/docs/README.es.md
@@ -332,12 +332,12 @@ La auditoría necesita el servidor en marcha y `npx playwright install chromium`
 
 
 ```bash
-npm test          # 347, unos 1,5 s, sin red
+npm test          # 362, unos 1,5 s, sin red
 ```
 
 Cubren **las tres reglas recuperadas del modelo**: el número de argumentos decide rejilla o lista, el número de planes decide tarjeta única o comparativa, y la existencia de una captura de interfaz decide la composición de la portada. Si alguna se desvía, la decisión vuelve en silencio a un modelo que no puede tomarla, así que son las que no deben moverse.
 
-También se cubren: el control de disponibilidad (un array vacío cuenta como ausente, no como listo), el orden de finalización de `asSettled`, y las aristas del serializador de JSX —las propiedades personalizadas necesitan `as CSSProperties`, los punto y coma dentro de un degradado no son separadores, el texto con llaves debe envolverse, y ni la clase de animación `blk-in` ni el bloque `<style>` pueden llegar a la exportación—. Las superficies dirigidas a agentes reciben el mismo trato: `bundle.zip` se vuelve a leer con un segundo lector de zip, deliberadamente lento, escrito en el propio archivo de pruebas y no con el escritor que lo produjo; `/llms.txt` se analiza contra la forma de llmstxt.org y se coteja línea a línea con las tablas reales de bloques, temas y fuentes; y al servidor MCP se le hace pasar por el saludo, por todas las herramientas que anuncia y por una serie de mensajes que llegan rotos.
+También se cubren: el contrato del catálogo, ahora exigido y no solo declarado — un bloque cuyas props no satisfacen el esquema que `lib/catalog.ts` le fija guarda su sitio como esqueleto en lugar de llegar a un renderizador que se limita a castear; el control de disponibilidad (un array vacío cuenta como ausente, no como listo), el orden de finalización de `asSettled`, y las aristas del serializador de JSX —las propiedades personalizadas necesitan `as CSSProperties`, los punto y coma dentro de un degradado no son separadores, el texto con llaves debe envolverse, y ni la clase de animación `blk-in` ni el bloque `<style>` pueden llegar a la exportación—. Las superficies dirigidas a agentes reciben el mismo trato: `bundle.zip` se vuelve a leer con un segundo lector de zip, deliberadamente lento, escrito en el propio archivo de pruebas y no con el escritor que lo produjo; `/llms.txt` se analiza contra la forma de llmstxt.org y se coteja línea a línea con las tablas reales de bloques, temas y fuentes; y al servidor MCP se le hace pasar por el saludo, por todas las herramientas que anuncia y por una serie de mensajes que llegan rotos.
 
 Además, invariantes estructurales: cada slot que referencia un arquetipo debe existir, obligatorios y opcionales no pueden solaparse, `SLOT_ORDER` debe cubrir cada slot exactamente una vez, y cada variante debe declarar los campos que necesita.
 
diff --git a/docs/README.fr.md b/docs/README.fr.md
index 65ab490..fc4b01d 100644
--- a/docs/README.fr.md
+++ b/docs/README.fr.md
@@ -333,12 +333,12 @@ L'audit a besoin d'un serveur lancé et de `npx playwright install chromium`, il
 
 
 ```bash
-npm test          # 347, environ 1,5 s, sans réseau
+npm test          # 362, environ 1,5 s, sans réseau
 ```
 
 Ils couvrent **les trois règles reprises au modèle** : le nombre d'arguments décide grille ou liste, le nombre de paliers décide carte unique ou comparatif, et la présence d'une capture d'interface décide la mise en page de l'en-tête. Si l'une dérive, la décision retourne en silence à un modèle incapable de la prendre : ce sont celles qui ne doivent pas bouger.
 
-Sont également couverts : le contrôle de disponibilité (un tableau vide compte comme absent, pas comme prêt), l'ordre d'achèvement de `asSettled`, et les pièges du sérialiseur JSX — les propriétés personnalisées ont besoin de `as CSSProperties`, les points-virgules d'un dégradé ne sont pas des séparateurs, un texte contenant des accolades doit être encadré, et ni la classe d'animation `blk-in` ni le bloc `<style>` ne doivent atteindre l'export. Les surfaces destinées aux agents reçoivent le même traitement : `bundle.zip` est relu par un second lecteur de zip, délibérément lent, écrit dans le fichier de test et non par l'écrivain qui l'a produit ; `/llms.txt` est analysé contre la forme de llmstxt.org et confronté ligne à ligne aux vraies tables de blocs, de thèmes et de sources ; et le serveur MCP est mené à travers la poignée de main, chacun des outils qu'il annonce, et une série de messages qui arrivent cassés.
+Sont également couverts : le contrat du catalogue, désormais appliqué et non plus seulement déclaré — un bloc dont les props ne satisfont pas le schéma que `lib/catalog.ts` lui fixe garde sa place en squelette plutôt que d'atteindre un moteur de rendu qui se contente d'un cast ; le contrôle de disponibilité (un tableau vide compte comme absent, pas comme prêt), l'ordre d'achèvement de `asSettled`, et les pièges du sérialiseur JSX — les propriétés personnalisées ont besoin de `as CSSProperties`, les points-virgules d'un dégradé ne sont pas des séparateurs, un texte contenant des accolades doit être encadré, et ni la classe d'animation `blk-in` ni le bloc `<style>` ne doivent atteindre l'export. Les surfaces destinées aux agents reçoivent le même traitement : `bundle.zip` est relu par un second lecteur de zip, délibérément lent, écrit dans le fichier de test et non par l'écrivain qui l'a produit ; `/llms.txt` est analysé contre la forme de llmstxt.org et confronté ligne à ligne aux vraies tables de blocs, de thèmes et de sources ; et le serveur MCP est mené à travers la poignée de main, chacun des outils qu'il annonce, et une série de messages qui arrivent cassés.
 
 Plus des invariants structurels : tout slot référencé par un archétype doit exister, obligatoires et facultatifs ne doivent pas se recouper, `SLOT_ORDER` doit couvrir chaque slot exactement une fois, et chaque variante doit déclarer les champs dont elle a besoin.
 
diff --git a/docs/README.ja.md b/docs/README.ja.md
index 4941b67..b03a84a 100644
--- a/docs/README.ja.md
+++ b/docs/README.ja.md
@@ -335,12 +335,12 @@ npm run audit:a11y   # 生成結果に axe-core、6 テーマすべて
 
 
 ```bash
-npm test          # 347 件、約 1.5 秒、ネットワーク不使用
+npm test          # 362 件、約 1.5 秒、ネットワーク不使用
 ```
 
 中心は**モデルから取り戻した三つの規則**です——売りの個数がグリッドかリストかを決め、料金段階数が単一か比較かを決め、画面写真の有無がファーストビューの版を決める。ここが戻ると、判断は答えられないモデルに黙って返されてしまうので、最も動いてはいけない部分です。
 
-ほかに準備完了の門（空配列は準備済みではなく欠落として扱う）、`asSettled` の完了順、そして JSX 直列化の落とし穴——カスタムプロパティには `as CSSProperties` が要る、グラデーション内のセミコロンは区切りではない、波括弧を含む文字列は包む必要がある、`blk-in` アニメーションクラスと `<style>` は書き出しに入れてはいけない。エージェント向けの面も同じ扱いです。`bundle.zip` は、それを書いた側ではなくテストファイルに別途書いた、わざと素朴な zip リーダーで読み戻します。`/llms.txt` は llmstxt.org の形として解析し、実際のブロック・テーマ・供給元の表と一行ずつ突き合わせます。MCP サーバーはハンドシェイク、公開しているすべてのツール、そして壊れた形で届く一連のメッセージを通して動かします。
+ほかにカタログの契約——宣言されるだけでなく実際に検査されるようになりました。`lib/catalog.ts` が定めたスキーマを props が満たさないブロックは、型を鵜呑みにするレンダラーへ渡らずスケルトンのまま場所を保ちます。加えて準備完了の門（空配列は準備済みではなく欠落として扱う）、`asSettled` の完了順、そして JSX 直列化の落とし穴——カスタムプロパティには `as CSSProperties` が要る、グラデーション内のセミコロンは区切りではない、波括弧を含む文字列は包む必要がある、`blk-in` アニメーションクラスと `<style>` は書き出しに入れてはいけない。エージェント向けの面も同じ扱いです。`bundle.zip` は、それを書いた側ではなくテストファイルに別途書いた、わざと素朴な zip リーダーで読み戻します。`/llms.txt` は llmstxt.org の形として解析し、実際のブロック・テーマ・供給元の表と一行ずつ突き合わせます。MCP サーバーはハンドシェイク、公開しているすべてのツール、そして壊れた形で届く一連のメッセージを通して動かします。
 
 構造の不変条件も：原型が参照するスロットは必ず存在すること、必須と任意が重ならないこと、`SLOT_ORDER` が全スロットを過不足なく覆うこと、各バリアントが必要なフィールドを宣言していること。
 
diff --git a/docs/README.ko.md b/docs/README.ko.md
index a0e42f7..53efba0 100644
--- a/docs/README.ko.md
+++ b/docs/README.ko.md
@@ -335,12 +335,12 @@ npm run audit:a11y   # 생성 결과에 axe-core, 여섯 테마 전부
 
 
 ```bash
-npm test          # 347개, 약 1.5초, 네트워크 미사용
+npm test          # 362개, 약 1.5초, 네트워크 미사용
 ```
 
 핵심은 **모델에게서 되찾아온 세 규칙**입니다 — 강점 개수가 그리드냐 리스트냐를, 요금 단계 수가 단일이냐 비교냐를, 화면 스크린샷 유무가 첫 화면 판을 정합니다. 여기가 되돌아가면 결정이 답할 수 없는 모델에게 조용히 넘어가므로, 가장 흔들리면 안 되는 부분입니다.
 
-그 밖에 준비 완료 게이트(빈 배열은 준비됨이 아니라 누락으로 취급), `asSettled` 의 완료 순서, 그리고 JSX 직렬화의 함정 — 사용자 정의 속성에는 `as CSSProperties` 가 필요하고, 그라디언트 안의 세미콜론은 구분자가 아니며, 중괄호를 포함한 텍스트는 감싸야 하고, `blk-in` 애니메이션 클래스와 `<style>` 블록은 내보내기에 들어가면 안 됩니다. 에이전트를 향한 면들도 같은 대우를 받습니다. `bundle.zip` 은 그것을 만든 쓰기 쪽이 아니라 테스트 파일에 따로 쓴, 일부러 느리게 만든 zip 리더로 다시 읽습니다. `/llms.txt` 는 llmstxt.org 형태로 파싱해 실제 블록·테마·출처 표와 한 줄씩 대조합니다. MCP 서버는 핸드셰이크와, 스스로 광고하는 모든 도구와, 망가진 채로 도착하는 일련의 메시지를 통해 돌려 봅니다.
+그 밖에 카탈로그 계약 — 이제 선언에 그치지 않고 실제로 검사됩니다. `lib/catalog.ts` 가 정한 스키마를 props 가 만족하지 못하는 블록은 타입을 그대로 믿는 렌더러에 닿지 않고 스켈레톤으로 자리를 지킵니다. 그리고 준비 완료 게이트(빈 배열은 준비됨이 아니라 누락으로 취급), `asSettled` 의 완료 순서, 그리고 JSX 직렬화의 함정 — 사용자 정의 속성에는 `as CSSProperties` 가 필요하고, 그라디언트 안의 세미콜론은 구분자가 아니며, 중괄호를 포함한 텍스트는 감싸야 하고, `blk-in` 애니메이션 클래스와 `<style>` 블록은 내보내기에 들어가면 안 됩니다. 에이전트를 향한 면들도 같은 대우를 받습니다. `bundle.zip` 은 그것을 만든 쓰기 쪽이 아니라 테스트 파일에 따로 쓴, 일부러 느리게 만든 zip 리더로 다시 읽습니다. `/llms.txt` 는 llmstxt.org 형태로 파싱해 실제 블록·테마·출처 표와 한 줄씩 대조합니다. MCP 서버는 핸드셰이크와, 스스로 광고하는 모든 도구와, 망가진 채로 도착하는 일련의 메시지를 통해 돌려 봅니다.
 
 구조 불변식도 있습니다: 원형이 참조하는 슬롯은 반드시 존재할 것, 필수와 선택이 겹치지 않을 것, `SLOT_ORDER` 가 모든 슬롯을 빠짐없이 한 번씩 덮을 것, 각 변형이 필요한 필드를 선언할 것.
 
diff --git a/docs/README.pt.md b/docs/README.pt.md
index 6f4fc08..9e93f19 100644
--- a/docs/README.pt.md
+++ b/docs/README.pt.md
@@ -332,12 +332,12 @@ A auditoria precisa do servidor no ar e de `npx playwright install chromium`, po
 
 
 ```bash
-npm test          # 347 deles, cerca de 1,5 s, sem rede
+npm test          # 362 deles, cerca de 1,5 s, sem rede
 ```
 
 Eles cobrem **as três regras retomadas do modelo**: a quantidade de diferenciais decide grade ou lista, a quantidade de planos decide cartão único ou comparativo, e a existência de uma captura de interface decide o layout do topo. Se alguma delas escorregar, a decisão volta em silêncio para um modelo que não consegue tomá-la — são as que não podem se mexer.
 
-Também são cobertos: a liberação por prontidão (um array vazio conta como ausente, não como pronto), a ordem de conclusão do `asSettled`, e as arestas do serializador de JSX — propriedades customizadas precisam de `as CSSProperties`, ponto e vírgula dentro de um gradiente não é separador, texto com chaves precisa ser envolvido, e nem a classe de animação `blk-in` nem o bloco `<style>` podem chegar à exportação. As superfícies voltadas a agentes recebem o mesmo tratamento: o `bundle.zip` é relido por um segundo leitor de zip, deliberadamente lento, escrito no próprio arquivo de teste e não pelo escritor que o produziu; o `/llms.txt` é analisado contra o formato do llmstxt.org e conferido linha a linha com as tabelas reais de blocos, temas e fontes; e o servidor MCP é conduzido pelo aperto de mão, por cada ferramenta que ele anuncia e por uma série de mensagens que chegam quebradas.
+Também são cobertos: o contrato do catálogo, agora imposto e não apenas declarado — um bloco cujas props não satisfazem o esquema que `lib/catalog.ts` define para ele guarda o seu lugar como esqueleto em vez de chegar a um renderizador que apenas faz cast; a liberação por prontidão (um array vazio conta como ausente, não como pronto), a ordem de conclusão do `asSettled`, e as arestas do serializador de JSX — propriedades customizadas precisam de `as CSSProperties`, ponto e vírgula dentro de um gradiente não é separador, texto com chaves precisa ser envolvido, e nem a classe de animação `blk-in` nem o bloco `<style>` podem chegar à exportação. As superfícies voltadas a agentes recebem o mesmo tratamento: o `bundle.zip` é relido por um segundo leitor de zip, deliberadamente lento, escrito no próprio arquivo de teste e não pelo escritor que o produziu; o `/llms.txt` é analisado contra o formato do llmstxt.org e conferido linha a linha com as tabelas reais de blocos, temas e fontes; e o servidor MCP é conduzido pelo aperto de mão, por cada ferramenta que ele anuncia e por uma série de mensagens que chegam quebradas.
 
 Mais invariantes estruturais: todo slot referenciado por um arquétipo precisa existir, obrigatórios e opcionais não podem se sobrepor, `SLOT_ORDER` precisa cobrir cada slot exatamente uma vez, e cada variante precisa declarar os campos de que depende.
 
diff --git a/docs/README.zh.md b/docs/README.zh.md
index 14ce3c3..bd0f724 100644
--- a/docs/README.zh.md
+++ b/docs/README.zh.md
@@ -335,12 +335,12 @@ npm run audit:a11y   # axe-core 扫生成结果，六套主题全过一遍
 
 
 ```bash
-npm test          # 347 个，约 1.5 秒，不碰网络
+npm test          # 362 个，约 1.5 秒，不碰网络
 ```
 
 测的是**三条被从模型手里拿回来的规则**——卖点条数决定网格还是列表、价格档数决定单档还是对比、有没有界面截图决定首屏版式。这几条一旦回归，决策就悄悄还给了一个答不了的模型，所以它们最不该漂。
 
-另外测了就绪度门控（空数组算缺失而不是就绪）、`asSettled` 的完成顺序、以及 JSX 序列化的几个坑：CSS 自定义属性要带 `as CSSProperties`、渐变里的分号不能当分隔符、含花括号的文本要包起来、`blk-in` 动画类和 `<style>` 块不能带进导出。面向 agent 的那几个面也一样待遇：`bundle.zip` 由测试文件里另写的一个故意慢吞吞的 zip 读取器读回来，而不是用生成它的那个写入器；`/llms.txt` 按 llmstxt.org 的形状解析，并逐行和真实的区块、主题、来源表对账；MCP 服务则被完整走一遍握手、它对外声明的每个工具，以及一串本身就是坏的消息。
+另外测了目录契约——它现在是被执行的而不只是被声明的：props 不满足 `lib/catalog.ts` 为它写下的 schema 的区块，会以骨架占位，而不是进到一个只做类型断言的渲染器里；还测了就绪度门控（空数组算缺失而不是就绪）、`asSettled` 的完成顺序、以及 JSX 序列化的几个坑：CSS 自定义属性要带 `as CSSProperties`、渐变里的分号不能当分隔符、含花括号的文本要包起来、`blk-in` 动画类和 `<style>` 块不能带进导出。面向 agent 的那几个面也一样待遇：`bundle.zip` 由测试文件里另写的一个故意慢吞吞的 zip 读取器读回来，而不是用生成它的那个写入器；`/llms.txt` 按 llmstxt.org 的形状解析，并逐行和真实的区块、主题、来源表对账；MCP 服务则被完整走一遍握手、它对外声明的每个工具，以及一串本身就是坏的消息。
 
 还有几条结构不变量：每个原型引用的槽位必须存在、必需和可选不能重叠、`SLOT_ORDER` 必须不重不漏覆盖全部槽位、每个变体都得声明自己需要哪些字段。
 
diff --git a/lib/catalog.test.ts b/lib/catalog.test.ts
new file mode 100644
index 0000000..a928c3c
--- /dev/null
+++ b/lib/catalog.test.ts
@@ -0,0 +1,71 @@
+import { describe, expect, it } from "vitest";
+import { catalog, validateProps } from "./catalog";
+
+/**
+ * The catalog called itself the component contract and nothing enforced it.
+ *
+ * `catalog.validate()` checks that every element names a declared component and stops there: the spec below, whose `Pricing` carries the string `"免费"` where an array of tiers belongs, comes back `success: true` from it. That is the gap these tests stand in — the zod schemas were a description of what the model ought to send, and `validateProps` is what turns them into a check on what it did send.
+ *
+ * The case is not hypothetical. `isReady` gates on presence and non-blankness, and `"免费"` is present and not blank, so the block was declared ready and reached a renderer that writes `(props.tiers as ...).map` — a cast, not a check.
+ */
+
+const TIER = { name: "手冲", price: "38", period: "每杯", features: ["单一产区"], highlighted: true };
+const PRICING = { title: "价目", cta: "来一杯", tiers: [TIER] };
+
+describe("validateProps", () => {
+  it("accepts props that satisfy the component's own schema, so the gate cannot be passing by refusing everything", () => {
+    expect(validateProps("Pricing", PRICING)).toBeNull();
+    expect(validateProps("Skeleton", { kind: "section" })).toBeNull();
+    expect(validateProps("Page", { theme: "forest" })).toBeNull();
+  });
+
+  it("rejects a field of the wrong type, which is the whole reason it exists — isReady sees a non-blank string and calls it ready", () => {
+    const problem = validateProps("Pricing", { ...PRICING, tiers: "免费" });
+    expect(problem).not.toBeNull();
+    expect(problem!.component).toBe("Pricing");
+    expect(problem!.path).toBe("tiers");
+    expect(problem!.expected).toMatch(/array/i);
+  });
+
+  it("is stricter than catalog.validate, which is the claim this module is built on", () => {
+    // If this ever starts failing because catalog.validate grew prop checking, validateProps has become redundant and should be deleted rather than kept out of habit.
+    const spec = {
+      root: "root",
+      state: {},
+      elements: {
+        root: { type: "Page", props: { theme: "forest" }, children: ["p"] },
+        p: { type: "Pricing", props: { ...PRICING, tiers: "免费" }, children: [] },
+      },
+    };
+    expect(catalog.validate(spec).success).toBe(true);
+    expect(validateProps("Pricing", spec.elements.p.props)).not.toBeNull();
+  });
+
+  it("reports a nested path, so a log line says which field of which item was wrong", () => {
+    const problem = validateProps("Pricing", { ...PRICING, tiers: [{ ...TIER, features: "单一产区" }] });
+    expect(problem!.path).toBe("tiers.0.features");
+  });
+
+  it("rejects a missing required field rather than filling it in", () => {
+    const { cta: _cta, ...withoutCta } = PRICING;
+    expect(validateProps("Pricing", withoutCta)!.path).toBe("cta");
+  });
+
+  it("treats an inherited property name as no component at all, since the type can arrive from a model", () => {
+    // `components["constructor"]` is a function on every plain object. Indexing would have handed a function's `.props` to safeParse.
+    for (const name of ["constructor", "toString", "__proto__", "hasOwnProperty"]) {
+      const problem = validateProps(name, {});
+      expect(problem, `${name} resolved to something`).not.toBeNull();
+      expect(problem!.expected).toMatch(/component/);
+    }
+  });
+
+  it("covers every component the catalog declares, so a block added without a schema fails here rather than at render", () => {
+    const names = catalog.componentNames;
+    expect(names.length).toBeGreaterThanOrEqual(19);
+    for (const name of names) {
+      // Empty props satisfy no block in this catalog; what matters is that the lookup resolves and the schema runs rather than throwing.
+      expect(() => validateProps(name, {})).not.toThrow();
+    }
+  });
+});
diff --git a/lib/catalog.ts b/lib/catalog.ts
index 26aefe1..f3a7fc8 100644
--- a/lib/catalog.ts
+++ b/lib/catalog.ts
@@ -6,6 +6,10 @@ import { z } from "zod";
  * The component contract: every block the generator is allowed to produce, and
  * the exact props each one takes. Nothing outside this catalog can ever appear
  * in a generated page — that guarantee is the point of the whole design.
+ *
+ * The guarantee held for the component *names* and not for the props under them. `catalog.validate()` checks the spec's shape — that every element names a component this catalog declares — and stops there: a `Pricing` element whose `tiers` is the string `"免费"` returns `success: true` from it. The schemas below were therefore a description of what the LLM ought to send rather than a check on what it did send, and the only thing standing between a wrong-typed field and the renderer was `isReady`, which tests whether a value is present and non-blank, not whether it is the right kind of thing.
+ *
+ * `validateProps` closes that. It reads the very schemas declared here, so the contract is enforced by the file that states it and there is no second description of any block's shape to drift out of step.
  */
 export const catalog = defineCatalog(schema, {
   components: {
@@ -126,3 +130,32 @@ export const catalog = defineCatalog(schema, {
   },
   actions: {},
 });
+
+/** Why a block cannot be rendered as asked, phrased for a decision log rather than for a developer. */
+export type PropsProblem = { component: string; path: string; expected: string };
+
+/**
+ * Whether a set of props satisfies the schema its component declares above.
+ *
+ * The component name arrives from a table this repo owns, but the props arrive from a model, so the lookup is by `Object.hasOwn` rather than by indexing: `constructor` is not a component and must not resolve to one.
+ *
+ * A failure returns the first offending path rather than the whole issue list. The caller's move is the same whatever the count — hold the block back — and one path is what fits in a log line a person will actually read.
+ */
+export function validateProps(type: string, props: unknown): PropsProblem | null {
+  const components = catalog.data.components as Record<string, { props?: z.ZodType }>;
+  if (!Object.hasOwn(components, type)) return { component: type, path: "", expected: "a component this catalog declares" };
+
+  const shape = components[type]!.props;
+  if (!shape) return null;
+
+  const result = shape.safeParse(props);
+  if (result.success) return null;
+
+  const issue = result.error.issues[0]!;
+  return {
+    component: type,
+    path: issue.path.join("."),
+    // zod's own wording, because it names the type it wanted and the type it got, which is the whole content of the answer.
+    expected: issue.message,
+  };
+}
diff --git a/lib/compose.test.ts b/lib/compose.test.ts
index d4ebac1..3d687ef 100644
--- a/lib/compose.test.ts
+++ b/lib/compose.test.ts
@@ -1,6 +1,6 @@
 import { afterEach, describe, expect, it, vi } from "vitest";
 import { composePlanned } from "./compose";
-import { catalog } from "./catalog";
+import { catalog, validateProps } from "./catalog";
 
 /**
  * The orchestration seam had no test, and three of the audit's findings lived in it: a copy chunk that failed both its attempts took the whole page down, a Jev round that rejected while the identity chunk was still in flight became an unhandled rejection, and an auto slot that layoutRules never spoke for stayed a skeleton through to `complete` while the run still reported `finish`.
@@ -95,6 +95,8 @@ async function run(options: {
   wants?: Record<string, number>;
   secondJevRound?: "ok" | "500";
   abortOn?: ChunkName;
+  /** Overrides the theme the Jev stand-in answers with, including with a key that is not one of the six. */
+  themeChoice?: string;
 } = {}) {
   const copy = { ...DEFAULT_COPY, ...options.copy };
   const wants = options.wants ?? {};
@@ -122,8 +124,9 @@ async function run(options: {
       const answers: Record<string, unknown> = {};
       for (const [key, question] of Object.entries(questions)) {
         const slot = key.startsWith("want_") ? key.slice("want_".length) : null;
+        const first = Object.keys(question.criteria ?? {})[0] ?? "";
         answers[key] = {
-          choice: Object.keys(question.criteria ?? {})[0] ?? "",
+          choice: key === "theme" && options.themeChoice !== undefined ? options.themeChoice : first,
           confidence: 0.9,
           noul: slot ? (wants[slot] ?? 0) : 0,
         };
@@ -286,8 +289,10 @@ describe("composePlanned", () => {
     expect(threw).toBeNull();
     expect(types("slot_hero")).toBe("HeroCentered");
     expect(types("slot_gallery")).toBe("Gallery");
-    // The wrong-typed field never reaches the renderer as itself.
-    expect(Array.isArray(spec!.elements.slot_pricing!.props!.tiers)).toBe(true);
+
+    // This assertion used to read `Array.isArray(props.tiers) === true`, which pinned the coercion in elementsFor rather than the outcome: the string was replaced with `[]`, and an empty array is a legal `tiers`, so the page drew a pricing block with a heading, a button and no prices and every check was happy. The block now holds its place as a skeleton, which is the same thing the page does for copy that never arrived — the honest description of a block whose copy came back unusable.
+    expect(types("slot_pricing")).toBe("Skeleton");
+    expect(spec!.elements.slot_pricing!.props!.tiers).toBeUndefined();
   });
 
   it("ends the run when the signal is aborted rather than reporting each remaining chunk as a block that produced no copy", async () => {
@@ -303,4 +308,36 @@ describe("composePlanned", () => {
 
     expect(complete!.stopReason).toBe("finish");
   });
+
+  it("emits a spec whose every element satisfies its own schema, whatever the model answered", async () => {
+    // The blanket version of the test above: no matter which chunk goes wrong, nothing that fails its contract reaches the spec.
+    for (const broken of [
+      { commerce: { ...COMMERCE, tiers: "免费" } },
+      { social: { ...SOCIAL, testimonials: [{ quote: "好", name: "林" }] } },
+      { place: { ...PLACE, contactLabels: { address: "地址" } } },
+    ]) {
+      const { spec } = await run({ copy: broken, wants: LANDING_WANTS });
+      for (const [name, element] of Object.entries(spec!.elements)) {
+        expect(
+          validateProps(element.type, element.props ?? {}),
+          `${name} (${element.type}) reached the spec with props its schema rejects`,
+        ).toBeNull();
+      }
+    }
+  });
+
+  it("falls back to a theme that exists when the judgement names one that does not, rather than rendering forest under another name", async () => {
+    // themeVars answers an unknown key with forest and says nothing, so an unrecognised choice used to render green while the decision log, the exported tokens and the theme picker all claimed something else.
+    const { events, spec } = await run({ wants: LANDING_WANTS, themeChoice: "midnight-neon" });
+
+    const plan = events.find((event) => event.type === "plan")!;
+    expect(plan.theme).toBe("forest");
+    expect((spec!.elements.root.props as { theme: string }).theme).toBe("forest");
+  });
+
+  it("uses the judgement's theme when it names a real one, so the narrowing is not just refusing everything", async () => {
+    const { events } = await run({ wants: LANDING_WANTS, themeChoice: "terminal" });
+
+    expect(events.find((event) => event.type === "plan")!.theme).toBe("terminal");
+  });
 });
diff --git a/lib/compose.ts b/lib/compose.ts
index 0a1dfe0..b32132e 100644
--- a/lib/compose.ts
+++ b/lib/compose.ts
@@ -9,8 +9,9 @@ import {
   type ArchetypeKey,
   type SlotKey,
 } from "@/lib/plan";
+import { validateProps } from "@/lib/catalog";
 import { elementsFor, type SiteContent } from "@/lib/content";
-import { THEME_CRITERIA } from "@/lib/themes";
+import { isThemeKey, THEME_CRITERIA } from "@/lib/themes";
 import {
   asSettled,
   contextFrom,
@@ -195,7 +196,9 @@ export async function* composePlanned(
     languageConfidence = first.answers.chineseVariant.confidence ?? null;
   }
   const identityPromise = generateIdentity(llmKey, prompt, signal, language);
-  const themeKey = first.answers.theme?.choice ?? "forest";
+  // A Choice answer is a key out of a closed set, so this ought to be a formality — but it is a string by the time it gets here, and `themeVars` answers an unrecognised one with forest and no complaint. That is the right behaviour for a total function and the wrong place to find out: the page would render green, the decision log would name a theme nobody could see, and the exported tokens would belong to a different palette than the label beside them. Narrowing it here means the rest of the system only ever handles a key that exists.
+  const answeredTheme = first.answers.theme?.choice;
+  const themeKey = isThemeKey(answeredTheme) ? answeredTheme : "forest";
   const themeConfidence = first.answers.theme?.confidence ?? null;
   const archetypeKey = (first.answers.archetype?.choice ?? "landing") as ArchetypeKey;
   const archetype = ARCHETYPES[archetypeKey] ?? ARCHETYPES.landing;
@@ -282,7 +285,10 @@ export async function* composePlanned(
       const element = id ? elements[id] : undefined;
       // The frame is drawn from the plan alone; a block that has no copy yet
       // holds its place with a skeleton of the same shape.
-      const ready = element && isReady(id!, content);
+      //
+      // `isReady` asks whether the fields are there and carry something; it does not ask whether they are the right kind of thing, and it cannot, because the answer to that lives in the catalog's schemas rather than in a list of field names. A model that answers `"tiers": "免费"` instead of an array satisfies it — the string is present and not blank — and the Pricing block then reached the renderer, where `props.tiers.map` is a cast rather than a check. So the block's own contract is consulted here too, and a block whose props do not satisfy it holds its place as a skeleton exactly like one whose copy has not arrived. Degrading to the placeholder that already exists beats both alternatives: rendering a block that is wrong, and failing a page over one block.
+      const problem = element ? validateProps(element.type, element.props ?? {}) : null;
+      const ready = Boolean(element) && isReady(id!, content) && !problem;
       specElements[key] = ready
         ? { ...element, children: [] }
         : { type: "Skeleton", props: { kind: SKELETON_KIND[slot] ?? "section" }, children: [] };
diff --git a/lib/content.test.ts b/lib/content.test.ts
new file mode 100644
index 0000000..2cdff3b
--- /dev/null
+++ b/lib/content.test.ts
@@ -0,0 +1,46 @@
+import { describe, expect, it } from "vitest";
+import { validateProps } from "./catalog";
+import { elementsFor } from "./content";
+import { SLOTS } from "./plan";
+
+/**
+ * Element recipes must not repair what the model sent.
+ *
+ * `elementsFor` builds every variant's props eagerly, so a wrong-typed field has to be kept away from the one operation that would throw on it — `tiers.slice(0, 1).map(...)`. The obvious way to do that is to substitute an empty array, and that is what this function used to do. It stops the crash and it defeats the check: an empty array is a legal `tiers`, so the block satisfies its catalog schema, renders, and shows a price section with a heading, a button and no prices.
+ *
+ * The rule these tests hold in place is narrow: guard the operation, not the payload. What reaches the props is what the model sent, so the layer that knows what a tier list looks like can see that this is not one.
+ */
+
+const CONTENT = {
+  pricingTitle: "价目",
+  pricingCta: "来一杯",
+  tiers: [{ name: "手冲", price: "38", period: "每杯", features: ["单一产区"], highlighted: false }],
+};
+
+describe("elementsFor", () => {
+  it("hands every pricing variant the value it was given rather than an empty array standing in for it", () => {
+    // Both variants, by name from SLOTS rather than by hand, because the substitution was removed from one of them first and the other kept it.
+    for (const variant of Object.keys(SLOTS.pricing.variants)) {
+      const element = elementsFor({ ...CONTENT, tiers: "免费" } as never)[variant as "pricing_multi"];
+      expect(element.props.tiers, `${variant} replaced the model's answer`).toBe("免费");
+      expect(validateProps(element.type, element.props), `${variant} passed the contract check`).not.toBeNull();
+    }
+  });
+
+  it("still builds both pricing variants without throwing on that value, which is why the guard exists at all", () => {
+    // The crash this protects against destroyed pages that had no pricing block: every variant's props are built whether or not its slot was chosen.
+    expect(() => elementsFor({ ...CONTENT, tiers: "免费" } as never)).not.toThrow();
+    expect(() => elementsFor({ ...CONTENT, tiers: null } as never)).not.toThrow();
+    expect(() => elementsFor({} as never)).not.toThrow();
+  });
+
+  it("builds valid props from valid copy, so the checks above are not passing by rejecting everything", () => {
+    const elements = elementsFor(CONTENT as never);
+    for (const variant of Object.keys(SLOTS.pricing.variants)) {
+      const element = elements[variant as "pricing_multi"];
+      expect(validateProps(element.type, element.props), `${variant} rejected good copy`).toBeNull();
+    }
+    expect(elements.pricing_single.props.tiers).toHaveLength(1);
+    expect((elements.pricing_single.props.tiers as { highlighted: boolean }[])[0]!.highlighted).toBe(true);
+  });
+});
diff --git a/lib/content.ts b/lib/content.ts
index 51982ad..37dbf59 100644
--- a/lib/content.ts
+++ b/lib/content.ts
@@ -65,8 +65,10 @@ export type SiteContent = {
 
 /** Fill every block template with the generated content. */
 export function elementsFor(content: SiteContent) {
-  // Asked to price a free project, the model answers `"tiers": "免费"` — a string where the schema asked for an array, and valid JSON, so neither retry attempt fires. `(content.tiers ?? []).slice(0, 1).map(...)` was the only eager array operation in this function, so that string threw `.map is not a function` inside the generator and destroyed a page that had no pricing block in it at all. Both pricing variants now read the same guarded value, so a wrong-typed field costs its own block and nothing else. Every other array here is handed to the renderer untouched and only reaches `.map` if its block was chosen and passed isReady.
-  const tiers = Array.isArray(content.tiers) ? content.tiers : [];
+  // Asked to price a free project, the model answers `"tiers": "免费"` — a string where the schema asked for an array, and valid JSON, so neither retry attempt fires. `(content.tiers ?? []).slice(0, 1).map(...)` was the only eager array operation in this function, so that string threw `.map is not a function` inside the generator and destroyed a page that had no pricing block in it at all.
+  //
+  // So the guard exists to keep that operation from throwing — and only that. What goes into the props is whatever the model actually sent, because coercing it to `[]` here laundered a contract violation into something that satisfies the catalog: an empty array is a legal `tiers`, so validateProps passed it and the page drew a pricing block with a heading, a button and no prices. Guard the operation, not the payload; a value that cannot be a tier list is then visible to the check that knows what one is, and the block holds its place as a skeleton instead.
+  const tierList = Array.isArray(content.tiers) ? content.tiers : [];
   return {
     page: { type: "Page", props: { theme: "auto" } },
     nav_standard: {
@@ -146,12 +148,14 @@ export function elementsFor(content: SiteContent) {
       props: {
         cta: content.pricingCta,
         title: content.pricingTitle,
-        tiers: tiers.slice(0, 1).map((t) => ({ ...t, highlighted: true })),
+        tiers: Array.isArray(content.tiers)
+          ? tierList.slice(0, 1).map((t) => ({ ...t, highlighted: true }))
+          : content.tiers,
       },
     },
     pricing_multi: {
       type: "Pricing",
-      props: { title: content.pricingTitle, tiers, cta: content.pricingCta },
+      props: { title: content.pricingTitle, tiers: content.tiers, cta: content.pricingCta },
     },
     testimonials: {
       type: "Testimonials",
diff --git a/lib/plan.test.ts b/lib/plan.test.ts
index 8ccf82c..8797aa7 100644
--- a/lib/plan.test.ts
+++ b/lib/plan.test.ts
@@ -23,6 +23,15 @@ describe("layoutRules", () => {
     expect(layoutRules({ features: [] })).toEqual([]);
   });
 
+  it("counts nothing from a field that is not a list, because a string's length is not an answer to how many", () => {
+    // `"tiers": "免费"` is what the model sends when asked to price a free project. It is valid JSON, so no retry fires; it is two characters long, so reading `.length` off it elected the three-column comparison layout for a business with no tiers at all. The rule exists to count things, and a value that cannot be counted is not a small count — it is no answer.
+    expect(layoutRules({ tiers: "免费" })).toEqual([]);
+    expect(layoutRules({ features: "当日烘焙、单一产区、自带杯" })).toEqual([]);
+    expect(layoutRules({ tiers: 3 })).toEqual([]);
+    expect(layoutRules({ tiers: { basic: {}, pro: {} } })).toEqual([]);
+    expect(layoutRules({ visualKind: 1 })).toEqual([]);
+  });
+
   it("shows one price card for a single way to buy, a comparison for several", () => {
     expect(layoutRules({ tiers: [{}] })[0]?.id).toBe("pricing_single");
     expect(layoutRules({ tiers: [{}, {}] })[0]?.id).toBe("pricing_multi");
diff --git a/lib/plan.ts b/lib/plan.ts
index 24b2051..e74ede1 100644
--- a/lib/plan.ts
+++ b/lib/plan.ts
@@ -227,18 +227,20 @@ export const SLOT_ORDER: SlotKey[] = [
 /**
  * Layout rules code owns. These follow from the content itself, so asking the
  * model would only add a round trip and a low-confidence answer.
+ *
+ * The counts are taken with `Array.isArray` rather than by reading `.length`, and the parameter says `unknown` rather than `unknown[]` so that nothing else can be written. The fields arrive from `JSON.parse` of a model's reply, where the declared type is a hope rather than a fact: `"tiers": "免费"` is two characters long, and reading `.length` off it elected the multi-tier comparison layout for a business with no tiers at all — a rule that exists to count things silently counting the wrong thing. A field that is not an array is not an answer to "how many", so it counts as none and the rule does not fire.
  */
 export function layoutRules(content: {
-  features?: unknown[];
-  featuresDeep?: unknown[];
-  tiers?: unknown[];
-  visualKind?: string;
+  features?: unknown;
+  featuresDeep?: unknown;
+  tiers?: unknown;
+  visualKind?: unknown;
 }): { slot: SlotKey; id: string; because: string }[] {
   const rules: { slot: SlotKey; id: string; because: string }[] = [];
 
   // The split hero exists to hold a screenshot. Without one its right column is
   // an empty box, so the business's visual kind decides this, not taste.
-  if (content.visualKind) {
+  if (typeof content.visualKind === "string" && content.visualKind !== "") {
     const split = content.visualKind === "interface";
     rules.push({
       slot: "hero",
@@ -247,7 +249,7 @@ export function layoutRules(content: {
     });
   }
 
-  const featureCount = content.features?.length ?? 0;
+  const featureCount = Array.isArray(content.features) ? content.features.length : 0;
   if (featureCount > 0) {
     const grid = featureCount >= 5;
     rules.push({
@@ -257,7 +259,7 @@ export function layoutRules(content: {
     });
   }
 
-  const tierCount = content.tiers?.length ?? 0;
+  const tierCount = Array.isArray(content.tiers) ? content.tiers.length : 0;
   if (tierCount > 0) {
     const multi = tierCount >= 2;
     rules.push({
diff --git a/lib/themes.test.ts b/lib/themes.test.ts
index 2d4202e..c139150 100644
--- a/lib/themes.test.ts
+++ b/lib/themes.test.ts
@@ -1,7 +1,7 @@
 import { readFileSync } from "node:fs";
 import { join } from "node:path";
 import { describe, expect, it } from "vitest";
-import { THEMES, themeVars } from "./themes";
+import { isThemeKey, THEMES, themeVars } from "./themes";
 
 /**
  * Contrast is a property of the token values, so it can be checked without a browser. A theme that ships unreadable buttons is a defect in the generator, not a matter of taste, and it would otherwise only surface in an audit of one generated page that happened to use that theme.
@@ -113,4 +113,12 @@ describe("themeVars", () => {
   it("falls back to a real theme for an unknown name", () => {
     expect(themeVars("nope")).toEqual(themeVars("forest"));
   });
+
+  it("tells a real theme name from anything else, so the fallback above stops being the only thing that notices", () => {
+    // themeVars has to answer something — the renderer cannot draw nothing — and answering forest is right. What was missing is any way to find out it happened: an unrecognised key rendered green while the decision log, the theme picker and the exported tokens all named something else. isThemeKey is what the boundaries call before the value gets that far.
+    for (const key of Object.keys(THEMES)) expect(isThemeKey(key)).toBe(true);
+    for (const value of ["nope", "midnight-neon", "Forest", "", "constructor", "toString", null, undefined, 7, ["forest"], { forest: true }]) {
+      expect(isThemeKey(value), `${String(value)} passed as a theme`).toBe(false);
+    }
+  });
 });
diff --git a/lib/themes.ts b/lib/themes.ts
index 36b2969..b23622f 100644
--- a/lib/themes.ts
+++ b/lib/themes.ts
@@ -122,6 +122,15 @@ export const THEME_CRITERIA = Object.fromEntries(
   Object.entries(THEMES).map(([key, theme]) => [key, theme.description]),
 );
 
+/**
+ * Whether a string is one of the six, narrowing it where model output enters the system.
+ *
+ * `themeVars` below answers anything it does not recognise with forest rather than throwing, which is what its callers need — the renderer has to draw something, and the MCP tool wants the fallback so it can tell an agent which palette it actually got. The cost of that is silence: a typo or a hallucinated key renders green everywhere with nothing reported. So the check lives here and is applied at the boundary the value crosses, and the total function stays total.
+ */
+export function isThemeKey(value: unknown): value is ThemeKey {
+  return typeof value === "string" && Object.hasOwn(THEMES, value);
+}
+
 /** Inline CSS variables, so the registry never hardcodes a palette. */
 export function themeVars(key: string): Record<string, string> {
   const theme = THEMES[key] ?? THEMES.forest!;