chore(product): capture PRODUCT.md for the impeccable workflow

[mrsibe]

What does this PR do?

Adds PRODUCT.md, the product record the impeccable workflow reads. It is a new top-level document next to DESIGN.md; the two are deliberately separate — DESIGN.md owns the visual system, PRODUCT.md owns product truth.

Why?

impeccable context reports:

NO_PRODUCT_MD
BUILD_INIT_REQUIRED: Before shape or any new-surface/redesign flow, init must capture PRODUCT.md.

Narrow refinements are allowed to proceed without it, which is how the last four PRs got through. But any new surface or redesign is blocked: the agent has no record of who the product is for, what it must not claim, or what evidence exists, so it would be inventing all of it.

Important: this was not written from an interview

The init flow requires a discovery interview, and I asked the three questions in the previous message. The answer was "just do it". So this file is written from the repository, and it says so in a provenance block at the top. Concretely:

• Sourced facts name their artifact — README, [Epic] v1.4 — Trusted Research Loop: source provenance end to end #82 (the v1.4 epic), [UX] Workspace shell & IA: Library → Reading/Chat → Notes as one workflow #65 (workspace shell & IA), refactor(models): replace provider registry with protocol-based model connections #44 (protocol-based model connections), DESIGN.md, CONTRIBUTING.md, package.json.
• Everything read out of code or the stated direction rather than written down is marked [inferred], and the header tells the next reader to confirm or correct those before treating them as settled.
• Two contradictions are recorded as open questions rather than resolved by guessing — see below.

Please correct this file rather than living with a wrong guess in it. It is the record every later design round will read.

What it records

• Platform: web — an Electron shell, so the interface is drawn by a web engine; adaptive would be wrong because the design language does not switch per OS. Shipped artifacts being Windows/macOS-only is recorded under Operating Context as a release-pipeline fact, not a platform fact.
• Positioning — the part of [Epic] v1.4 — Trusted Research Loop: source provenance end to end #82 that is genuinely load-bearing: a citation resolves to a source location, not to a chunk, so re-chunking or changing embedding model cannot invalidate a citation. That constrains the indexing path, which is why a neighbouring product cannot copy it by shipping a feature.
• The maintainer's own correction as a commitment — [Epic] v1.4 — Trusted Research Loop: source provenance end to end #82 says the README's traceability claim was "ahead of the code" and provenance was being actively discarded. That is written in as a standing principle ("say what is not there"), because the habit is load-bearing for this product's credibility.
• Operating Context — bring-your-own-model, offline retrieval as a supported state, one vector table per notebook with its own width, two locales kept in sync, DESIGN.md + check:design as the interface authority.
• Evidence on Hand, including the absences — the only screenshot, the parser fixtures, the roadmap issues; and explicitly: no testimonials, no case studies, no benchmarks, no user counts, no pricing, and later work must not author any of them.

Open questions this file does not answer

1. The README and the code disagree about scope. The README's "What is not here yet" says quiz generation, audio transcription and slide generation are "in development" and "not in any release" — but QuizPage, AnkiPage, QuizService and AnkiCardService are implemented in the renderer and main process. Which statement is current decides whether those surfaces get promoted or hidden.
2. No accessibility standard is named anywhere — not WCAG 2.2 AA, not anything. What is enforced today (hover/selected/focus-visible/disabled on every interactive surface, both themes usable, state never carried by colour alone, the keyboard path [UX] Workspace shell & IA: Library → Reading/Chat → Notes as one workflow #65 requires) is recorded as fact; the target standard is recorded as undecided.

Notes

• No buildPath is recorded. impeccable context reports no image generation in this tool surface, and the init reference is explicit that without image generation there is no choice to record — silence is the correct outcome, not an omission.
• No .impeccable/config.json is created. Live mode is skipped: impeccable live is web-only and this is an Electron app.
• Documentation only. No code, no tokens, no rendered output changes.

How was this tested?

• impeccable context now resolves PRODUCT.md and reports platform: web; NO_PRODUCT_MD and BUILD_INIT_REQUIRED are gone.
• impeccable doctor --json — productPath and platform resolve, and no new findings are introduced. The one remaining finding is the pre-existing design-md-coverage on DESIGN.md, described below.
• npx prettier --check PRODUCT.md — clean.
• Every claim in the file was read out of the artifact it cites before being written.

One finding this PR does not fix

impeccable doctor still reports design-md-coverage (severity: mention): "DESIGN.md has no colors, typography, components section."

That is a heading-name mismatch, not missing content — the content exists under ## Surfaces, ## Type scale and text hierarchy and ## Component recipes. The offered fix is /impeccable document, which regenerates DESIGN.md from the code and would replace a hand-authored document that four PRs have been editing, so I did not run it unilaterally. Two options if you want the check to pass:

• run /impeccable document and review the diff carefully, or
• rename the three headings (and let document decide nothing else).

Checklist

• I have reviewed my own changes.
• npm run typecheck passes. (no code touched)
• npm run build passes. (no code touched)
• I have tested the affected user workflow. (n/a — documentation)
• I have not included unrelated changes.
• I have updated documentation when necessary.

Desktop / build changes

• Not applicable