The token-permission picker's design asset is THREE rows behind its measurement — re-measure the two-column split, or say the numbers are no longer drawn

tests/settings/permissionMeta.test.tsx asserts the token-permission picker splits into two columns of a literal 6 and 5 rows. Those literals are a tripwire on a design asset whose measurement was taken at MOTIR-2578 — and the grantable set has grown three times since without the asset being re-measured.

The record, which lives only in that test file's comments

Each of the last three left a note asking for a re-measure "when the set next grows", and each time the set grew the note was renewed instead of discharged. This card is that discharge — it is filed because a deferral naming no card is an orphan by construction, and this one has been renewed three times.

What is NOT broken

The three real invariants pass untouched and are what actually hold the layout: the columns balance within one row, no domain group is broken across a column, and the two columns sum to the grantable total. Nothing is visually wrong today — the picker renders correctly at 6/5. What is stale is the ASSET the numbers were measured from, and the honest reading of a growing gap is that the drawing no longer describes what ships.

What to decide

The card's real question is not "redraw it" — it is whether a row count belongs in a design asset at all for a set that grows every time a permission is minted:

• RE-MEASURE — refresh the asset at 11 keys and accept that the fourth growth files this card again; or
• DRAW THE RULE, NOT THE COUNT — re-cut the asset so it specifies the balance rule (two columns, balanced within one row, no group split) and shows a representative set rather than a pinned one. The test's three invariants already encode exactly that, which is evidence the rule is the durable statement and the literals are the perishable one.

Recommending the second, and the card should record which was chosen and why.

Acceptance criteria

• The asset under design/ for the token-permission picker is re-cut or re-measured against the CURRENT grantable set, and the three-file set (design-notes.md + .mock.html + .png) is complete.
• The card states which of the two dispositions was taken, and why.
• If DRAW THE RULE is chosen, permissionMeta.test.tsx's two literal row-count assertions are replaced by the balance rule they are a proxy for, and the renewed comment chain is deleted rather than extended.
• If RE-MEASURE is chosen, the comment says explicitly that the next growth re-opens this card, so the renewal is a known cost rather than an oversight.
• The design result is published onto this card (read the job log for Published N design artifact(s) — a failing guard in the same job skips the publish step silently).

Context refs

• tests/settings/permissionMeta.test.tsx — the three renewed comments and the two literals; the three invariants that actually hold the layout.
• lib/permissions/catalog.ts — PERMISSIONS, and why the project domain keeps its keys contiguous.
• MOTIR-2578 — where the asset was measured. MOTIR-3553 — the third growth, which surfaced this.